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Introduction- 


DIT vide its circular dated 29.1.2018, circulated the salient features of the Cloud Computing policy 
of the State and the operational instructions regarding the steps to be followed by the Departments. 


As per para 4 of the above circular and approval of High Power Committee (IT) in its meeting held 
on 8.3.2018, DIT carried out a tendering process for empanelment of Cloud Service Providers 
(CSPs) and discovery of rates for various cloud services. Since this process has been duly 
completed now, it is necessary to issue detailed instructions regarding CSP empanelment and the 
action expected from the Government organizations to ensure that all IT applications are migrated 
to cloud by 30.10.2018. Accordingly, the following instructions are being issued by the 
Government. 


Government Circular:- 


1. 


The following Cloud service providers (CSP) are being hereby empanelled by DIT for a 
period of 3 years for providing cloud services to the all Government Departments, sub- 
ordinate offices, Public Sector Undertakings, Urban and Rural Local Bodies & any 
body/organization set up under any law of the State Government (henceforth collectively 
referred to as “Government organizations”) from 1.5.2018 till 30.4.2021. 


Tier-1 empanelment 
1. Amazon Web Services 


2. Microsoft 

3. Net Magic 

4. Control-S (Conditional Empanelment for Sec-A of Annexure 8.1, 8.2 and 8.3 and not 
any other section) 


Tier-2 empanelment 
1. ESDS 


The total cumulative annual order value that can be awarded to CSPs in case of tier-2 
empanelment will be subject to an upper cap of Rs 25 crore (inclusive of all Departments). 
Information regarding cumulative annual order value already awarded to tier-2 empanelled 
CSPs will be made available to Government organizations on a regular basis. Tier-1 has no 
upper or lower limit. Government organizations should ensure adherence to the upper cap 
limit at the time of selection of the CSP. 


Cloud service offerings 


3.1 


The 3 cloud service offerings being provided by the empanelled CSPs are as follows. 


a) Public Cloud 
b) Virtual Private Cloud 
c) Government Community Cloud 
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3.2 


As part of each of these cloud service offerings, the following cloud services will be 
available to Government organizations 


Virtual machines 

Storage 

Database 

Media transcoding 

Services like DNS, Active directory, Virtual Private Network (VPN), API 
management, email/SMS gateway, back-up services, mobile services, developer 
tools and office productivity tools 

e Provision of Bare metal server as a service 


Rates for cloud services 


4.1 


4.2. 


4.3. 


4.4 


4.5 


The details of the CSP empanelled for each offering (Public, Virtual Private Cloud and 
Government Community Cloud) and the services listed above and the applicable rates are 
provided in Annexure-1. The applicable rates for the offerings and services are different for 
tier-1 and tier-2 CSPs. These rates will be applicable from 1.5.2018 till 30.4.2020 after 
which fresh rates will be notified by DIT by following due process. 


Three options- hourly rates, monthly rates if cloud services are taken for a minimum period 
of 1 year and monthly rates if cloud services are taken for a minimum period of 2 years are 
being made available to Government organizations. 


If any Government organization has already hosted its IT application on the cloud of any of 
the CSPs being empanelled by this GR under any existing contract/work order with the 
CSP and if the rate for the cloud services as per the contract/work order is lower than the 
rates notified in Annexure-1, the rates specified in the existing work order/contract will apply 
till the term of that contract. However, if the existing contract/work order rates are higher, 
the rates notified in Annexure-7 will apply from 1.5.2018. Foreclosure of Contract/work 
order can be done upto 31° October 2018. 


If any Government organization has already hosted its IT application on the cloud of any 
other CSP not empanelled under this GR or for an offering/service for which the CSP is not 
empanelled under this GR, the IT application has to be migrated to a CSP empanelled 
under this GR before 30.10.2018. 


To ensure that Government organizations get a hands-on experience, the Government 
organizations will be provided an option of free trial by the CSP for a limited period of 30 
days before issue of formal work order. 


Disaster Recovery (DR) services 


5. 


Rates have been discovered for Datacenter services (DC only), Disaster Recovery (DR) 
services (DR only) and Datacenter & Disaster Recovery services (DC + DR). Government 
organizations may opt for one or more of these as per their requirements. If required, 
Government organizations may opt for different CSPs for DC and DR services. 


Managed Service Providers (MSP) 


6.1 


A managed services provider (MSP) for this document is the cloud provider cloud services 
provider that manages and assumes responsibility for providing a defined set of services 
like Infrastructure as a Service (laaS), Software as a Service (SaaS) or Platform as a 
Service (PaaS) as per agreed term and conditions to Government organizations. 
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6.2 


Each CSP may appoint a maximum of 2 Managed Service Providers (MSP). The CSP can 
function as its own MSP. The MSPs already appointed by the empanelled CSPs are listed 
in Annexure-1. The MSP will perform the activities listed in Annexure-2. Government 
organizations may opt for the migration services of MSPs in addition to the regular cloud 
offerings. If the Government organization decides to engage the migration services of the 
MSP, additional charges of 5% (on the basic cloud services charges) towards MSP charges 
will apply for the period for which the services of MSP are engaged. 


Selection of CSP 


7. 


The Government organizations may select any of the empanelled CSPs_ through 
Departmental PC/PIC. Scope of work may be circulated to all empanelled CSP and 
presentation be done before PIC. After selection of the CSP, the Department may select 
any of the MSPs of the CSP, if required. If the Government organization has a system 
integrator or technical resource who can perform the technical tasks expected of a MSP, the 
Government organization can engage the system integrator or technical resource for 
performing the technical tasks instead of MSP. 


Guidelines for selection of cloud offering 


8.1 The following indicative guidelines should be used by Government organizations to decide 
the type of cloud offering (public cloud, virtual private cloud and Government community 
cloud) that they should opt for. 

Sr.no | Type of IT application Recommended 

cloud offering 

1 Websites with only read access for citizens/users Public Cloud 

2 IT applications collecting and storing information regarding public Public Cloud 
infrastructure and public assets like roads, buildings, bridges, water bodies, 
water conservation structures, water supply and sanitation, telecom and IT 
networks etc. (including GIS) covered under RTI Act. 

Finance and Planning Departments regarding payment of taxes, revenue 
receipts. 

3 IT applications involving collection of taxes, revenue, user fees and charges | Virtual Private 
for various G2B and G2C services and where personal sensitive Cloud 
information is NOT collected or stored 

4 IT applications involving collection and storage of information related to Virtual Private 
G2B services (Government to Business) cloud 

5 e IT applications involving collection and storage of information Virtual Private 

related to surveillance projects and safe and smart city projects in | Cloud 
the State 


e Finance and Planning Departments regarding budget distribution, 
drawing and disbursement of Government funds 
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6 Portals collecting and storing sensitive personal information of citizens like |Government 
Aadhaar number, demographic data including address, date of birth,ekYC |Community 
data, PAN number, Voter ID card number, bank account information, driving | Cloud 

license information, personal health records (any one or more of the above) 


7 Irrespective of the above criteria, Government 
Applications of the following Departments Community 
e Property records of Revenue Department Cloud 


e Applications related to urban planning and development control 
regulations 

e Public Health Department & Medical Education Department- 
including health insurance and hospital management and 
information systems 

e School Education Department 

e Women and Child Development Department 

e Individual beneficiary schemes of Social Justice, Tribal 
Development, VJNT and OBC Department, Minorities Development 
and Skills Development Department 

e Food and Civil Supplies Department 


8.2 DIT may update and make necessary changes/additions in cloud guidelines for selection of 
cloud offerings from time to time. 


8.3 It is clarified that the above cloud offering selection guidelines are indicative and 
Government organizations are free to choose the cloud service offering that would be 
suitable for them. While doing so, the Department should consider the nature and sensitivity 
of the data (in terms of data privacy, confidentiality, data concerning State & National 
security and requirements under the Right to Information Act) being handled by the 
application. 

8.4 Departments to provide Cloud SPOC, Nodal officer and authorized signatory names in 
Scope of Work circulated to CSPs/MSP for cloud services. 


Hosting/ Migration 


9.1 If the Department engages a MSP, the MSP will submit a detailed plan regarding cloud 
deployment and configuration after carrying out a detailed study of the proposed/existing IT 
application of the Department. On acceptance of the above plan by the user Department, 
the MSP will assist the Department in deploying/migrating the Departmental application 
onto the cloud. The MSP must assist the Department in carrying out functional testing and 
data integrity testing to ensure operational acceptance. If the Department is engaging DR 
services, the MSP should carry out business continuity testing. 


9.2 All Government organizations must ensure that all existing applications are migrated to 
cloud on or before 30.10.2018. 


Payments linked to utilization 


10.1 In the case of cloud services provisioned by user Government organizations, the billing for 
cloud services will be based on actual consumption of services (Pay-As-You-Go model) 
with zero capital (one- time) cost. 


10.2 To incentivize optimal solution design and encourage proper utilization of the assigned 
computing resources, empanelled CSP in co-ordination with the user Department should 
ensure that the average monthly utilization of RAM, CPU and storage is not less than 50%. 
If the average monthly utilization is less than 50% in a particular month, the CSP should 
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immediately notify the user Department. The user Department and the MSP/CSP should 
undertake a joint assessment within 15 days, analyze the reasons for the utilization being 
less than 50% and undertake steps to ensure resource utilization of at least 50%. If the 
average monthly utilization of RAM or CPU or storage is less than 50% for 2 successive 
months, a penalty of 25% of the monthly bill amount (from the next billing cycle) will apply 
for those particular months where utilization is below 50%. 


However, if the CSP has proposed a resource optimization plan to bring the average 
utilization above 50% but such plan has not been approved by the user Department 
authorized Signatory within the above time period of 2 months, the penalty will be waived 
off by DIT. 


10.3 If average monthly utilization exceeds 65%, an additional incentive of 5% of the monthly bill 
amount will be payable to the CSP for a period not exceeding 6 months. The expenditure 
towards cloud services will be borne by the user Department from their budgetary 
resources. It is clarified that DIT will not bear the expenditure centrally for availing cloud 
services. Empanelled Cloud Service providers will raise quarterly invoices to the respective 
Department. Payments should ordinarily be made by the respective user Department within 
1 month of the raising of the invoice. 


Management / Transition-Out Services 


11. CSP will provide a comprehensive exit management plan, with focus on sustainability and 
do Migration of the VMs, data, content and any other assets to the new environment or on 
alternate Managed Service Provider’s offerings and ensuring successful deployment and 
running of user Department's solution on the new infrastructure by suitably retrieving all 
data, scripts, software, virtual machine images, and so forth to enable mirroring or copying 
to Agency supplied industry standard media. 


12. CSP Ensure that all the documentation required for smooth transition including 
configuration documents are kept up to date. Once the exit process is completed, remove 
the data, content and other assets from the cloud environment and destroy the VM, Content 
and data of user Department. 


Performance Bank Guarantee 


13. In addition to a one-time performance bank guarantee (PBG) of Rs. 50 lakhs to be 
submitted by empanelled CSPs to DIT for the entire duration of this empanelment, a PBG of 
10% of the contract value should be submitted by MSP/CSP to respective user Department 
for the period of the work order, if work order value exceeds Rs. 5 lakhs in a financial year. 
Any penalties as per the Service Level Agreements (SLAs) may be recovered from this 
PBG. 


This Government Circular of Maharashtra Government is available at the website 
www.maharashtra.gov.in Reference no. for this is 201805171357566211. This order has been 
signed digitally. 


By order and in the name of the Governor of Maharashtra, 


Digitally signed by S VR Srinivas 
R DN: c=IN, postalCode=400020, st=Maharashtra, 
2.5.4.20=31d35fda97cba0c6a6cSe2ca7125fd8b 
a77201a47f0e7 1 dbf230047862bd061, 
ialNumber=914d8a9c1092ca4b44280033c71 


serial 
1 1 560ea75b2d56dcb4d3fc1 81 eb6dfcSfcbe63, 
riniVas sv Rstnves 


(S.V.R. Srinivas ) 
Principal Secretary IT, 
Government of Maharashtra. 
Copy forwarded to: 


1) Secretary to the Hon’ble Governor of Maharashtra 
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2) Secretary to Hon’ble Chief Minister, 

3) Personal Secretary to All Ministers/All Ministers of State, 

4) Hon’ble Leader of Opposition, Legislative Assembly/ Legislative council, Maharashtra 
Vidhan Mandal Sachiwalaya, Mumbai, 
All Hon’ble Members of Legislative Assembly/ Legislative Council, 
Personal Assistant to Chief Secretary, 
Additional Chief Secretary/Principal Secretary/Secretary of All Departments, 
Registrar, High Court (Original Side) Mumbai, 
Registrar, High Court (Appellate Side) Mumbai, 
Registrar, Lok Ayukta and Up Lok Ayukta, Maharashtra State Mumbai, 
Secretary State Election Commission, Mumbai 
Secretary, Maharashtra Public Service Commission Mumbai, 
Principal Secretary, Maharashtra Vidhan Mandal Sachiwalaya Mumbai, 
4) Chief Information Commissioner, State Information Commission, Mumbai, 
5) Auditor, Accountant General (A & E), Maharashtra Mumbai, 
6) Auditor, Accountant General (A & E), Maharashtra Nagpur, 
7) Auditor, Accountant General (Audit), Maharashtra Mumabai, 
8) Auditor, Accountant General (Audit), Maharashtra Nagpur, 
9) Pay and Accounts Officer, Mumbai, 
0) Residential Audit Officer, Mumbai, 
1) 
2) 
3) 
4) 
5) 
6) 


5) 
6) 
7) 
8) 
9) 
10) 
11) 
12) 
3) 


Commissioners of All Municipal Corporations, 

All Collectors, 

All Chief Executive Officer, Zilla Parishad/ All Chief Officers, 

Director General, Information and Public Relations, Mantralaya Mumbai, 
Managing Director, Maharashtra IT Corporation Mumbai, 


{ 
{ 
{ 
{ 
{ 
{ 
{ 
2 
2 
2 
2 
2 
2 
26) Select File, DIT, General Administration Department, Mantralaya. 
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Annexure 1 
Public Cloud 
Line Item# 5९00 Line Items DC-Public Cloud 1 year DR-Public Cloud 1 DC+DR-Public Cloud 
year 1 year 
VM cpu RAM Storage (GB) HOURLY MONTHLY HOURLY MONTHLY HOURLY MONTHLY 
rate rate rate rate rate rate 
me Pack 1 1 1 50 2.5 1800.0 2.3 1626.0 15.20 11153.00 
a, Pack 2 1 2 100 3.0 2160.0 2.7 1956.0 19.00 13961.20 
ma Pack 3 2 4 100 m3 4320.0 5.4 3912.0 31.36 22972.90 
| 4 Pack 4 2 | 8 150 me 5760.0 7.2 5232.0 41.00 28955.00 
5 Pack 5 2 16 150 12.0 8640.0 10.8 7872.0 44.00 30989.00 
pF Pack 6 4 4 200 10.0 7200.0 ma 6504.0 69.00 49565.00 
7 Pack 7 4 | | 250 12.0 8640.0 10.8 7824.0 69.00 49565.00 
8 Pack 8 4 16 250 16.0 11520.0 14.4 10464.0 69.00 51431.00 
PF Pack 9 | 6| pF 300 15.0 10800.0 13:5 9756.0 72.00 97917.00 
10 Pack 10 |e 12 350 18.0 12960.0 16.2 11736.0 137.00 98899.00 
11 Pack 11 शिळ शिक 400 20.0 14400.0 18.0 13008.0 137.00 98899.00 
12 Pack 12 i 16 450 24.0 17280.0 21.6 15648.0 137.00 98899.00 
13 Pack 13 | आ. 32 450 32.0 23040.0 28.8 20928.0 127.68 93474.30 
14 Pack 14 12 12 500 30.0 21600.0 27.0 19512.0 260.42 175000.75 
15 Pack 15 12 24 550 36.0 25920.0 32.4 23472.0 262.55 176432.37 
16 Pack 16 16 16 i 40.0 28800.0 36.0 26016.0 264.68 177863.98 
17 Pack 17 16 32 650 48.0 34560.0 43.2 31296.0 266.81 179295.59 
18 Pack 18 32 64 700 ma 69120.0 86.4 62592.0 575.71 386879 .33 
19 Pack 19 64 128 750 192.0 138240.0 172.8 125184.0 1081.83 726992.67 
20 Pack 20 128 256 800 2517:5 1843053.2 2517.5 1843053.2 5035.00 3686106.40 
21 Bandwidth-Plan 1- upto 100 GB 754.0 
22 Bandwidth-Plan 2- upto 500 GB 3927.0 
23 Bandwidth-Plan 3- upto 1000 GB 8000.0 
24 Additional data transfer tariff per GB Pe 
Line Item # SEC- B Line Items MONTHLY 
STORAGE rate 
25 Object storage 50 GB 118.75 
26 500 GB 737.00 
27 1000 GB 1,398.00 
28 10 TB 13,613.00 
29 File storage 50 GB 141.00 
Cae 500 GB 1,406.00 
31 1000 GB 2,813.00 
32 10 TB 25,571.00 
33 Archive storage 50 GB 10.00 
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34 500 GB 237.50 

35 1000 GB 475.00 

36 10 TB 4,864.00 

37 DISK storage 50 GB <= 120 IOPS 125.00 

38 121 to 400 IOPS 243.00 

39 401 to 800 IOPS 625.00 

[१७ | 801 to 1200 IOPS 800.00 

41 1201 to 2000 IOPS 1,125.00 

42 > 5000 IOPS 2,000.00 

43 500 GB <= 120 IOPS 1,250.00 

“a | 121 to 400 IOPS 1,696.00 

45 401 to 800 IOPS 1,696.00 

(6 17ै_ | 801 to 1200 IOPS 1,808.00 

47 1201 to 2000 IOPS 1,944.00 

[4४७ | > 5000 IOPS 7,727.00 

[१७ | 1000 68 <= 120 IOPS 2,500.00 

50 121 to 400 IOPS 3,212.00 

51 401 to 800 IOPS 3,212.00 

52 801 to 1200 IOPS 3,392.00 

53 1201 to 2000 IOPS 3,616.00 

54 > 5000 IOPS 8,035.00 

55 10 TB <= 120 IOPS 25,000.00 

56 121 to 400 IOPS 29,828.00 

57 401 to 800 IOPS 29,828.00 

58 801 to 1200 IOPS 29,828.00 

59 1201 to 2000 IOPS 29,828.00 

= > 5000 IOPS 44,011.00 

Line Item # SEC-C Database Options No. of Licenses required MONTHLY 

DATABASE rate 

61 Postgre Enterprise 4 34,868.63 
62 5 (08 69,639.04 
63 >8 153,421.98 
झिका MySQL 4 socket, 8 socket, 16 socket and 32 socket 4 socket 11,826.00 
65 8 socket 23,645.00 
ee | 16 socket 47,290.00 
67 32 socket 94,572.00 
| MySQL Standard 4 P| 
fe | 5to8 P| 
70 >8 ae 
71 MySQL Enterprise 4 P| 
72 5to8 lm 
73 >8 P| 
74 MSSQL 2012 Standard 4 21,976.00 
75 5to8 43,952.00 
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76 >8 87,904.00 
ee ee 
78 5to8 168,540.00 
79 >8 337,080.00 
[७७ | Oracle Standard 4 70,817.70 
81 5 to8 155,907.12 
82 >8 311,165.71 
83 Oracle Enterprise 4 Pt 
शि 5 [08 Po 
85 >8 P| 
(७. | NoSQL Enterprise 100 2,859.50 
87 101 to 500 14,297.50 
88 501 to 1000 28,595.00 
Pe > 1000 4,049.96 
er IBM DB2 v 10.5 or above 2 Po 
91 4 as 
92 10 mi: 
93 >10 a, 
a NoSQL DB 100 2,859.50 
95 101 to 500 14,297.50 
re 501 to 1000 28,595.00 
97 > 1000 28,595.00 
re MySQL & Postgre SQL compatible relational database 4 42,628.13 
—— 5to8 85,354.48 
100 >8 170,610.75 
SEC-D Media transcoding at 99.9% availability MONTHLY 

rate 

Quality Multiplier Po 

101 SD(1280X720) 1X per output minute 1.90 

102 HD (1280 x 720-1920 x 1080 2X per output minute 2.85 

103 UHD (more than 1920 x 1080, upto 4096 49 per output minute 10.06 
x 2160) 

104 Audio only output 0.25X per output minute 0.95 

Line Item # SEC-E SERVICES MONTHLY 

rate 

105 Scalability Virtual Machine Scale Sets/Auto Scaling 1 unit of 5 VMs 3,000.00 
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106 DNS DNS Management 1 51.30 
107 AD Active Directory Services 1 5,000.00 
108 VPN VPN/Gateway SITE to SITE point to point 2 ports per VPN 1,045.00 
109 API Gateway/ Million API calls 1 332.50 
Management 
110 Email/SMS Email gateway Per year cost for 1 60.00 
account with 10 GB 
111 SMS gateway 1 lakh sms per month 16,720.00 
112 Public IP Additional public IP Addresses 1 100.00 
113 DASHBOARDS Network Monitoring dash Board 1 1,000.00 
114 BACKUP Backup agent , Backup management and monitoring , Back 1 600.00 
Services up Restoration 
115 DATA TRANSFER Bulk Data Transfer 118 7,931.55 
116 DATA SYNC service 118 5,000.00 
117 Developer Tools = Tools & SDKs or equivalent 1 instance 16,525.00 
118 Code Deploy and commit tools or equivalent Linstance 95.00 
119 Mobile Services Mobile Hub or equivalent 1 93,936.00 
120 Mobile SDK 1 ae 
121 Container /Registry ग 9.50 
122 Office 365(Email Service with 100 GB Mail Box each for primary and archival, 1 शां 
Multiparty Video conferencing on PC, Laptop and tablets, personal data 
storage sync from PC to cloud, office productivity , search capabilities) or 
equivalent 
Line Item # SEC- F Bare Metal Servers MONTHLY 
rate 
123 Intel Xeon E7-8890 v4 (192 Cores, 2.20 GHz),8192GB RAM (8192GB maximum), 1 1,174,281.89 
Up to 29 Internal Hard Drives Up to 10Gbps maximum Port Speeds, Redundant 
Power Supplies, Hypervisor Licenses, network connectivity to internet or Cloud 
infrastructure 
124 Quad Intel Xeon E7-4890 v2 (60 Cores, 2.80 GHz) 2048GB RAM (2048GB 1 391,427.30 
maximum) Up to 24 Internal Hard Drives Up to 10Gbps maximum Port Speeds 
Redundant Power Supplies Hypervisor Licenses, network connectivity to 
internet or Cloud infrastructure 
SST Intel Xeon E5-2690 v4, Dual Intel Xeon E5-2690 v4 (28 Cores, 2.60 GHz) 256GB 1 88,071.14 
RAM (256GB maximum) Up to 2 Internal Hard Drives Up to 10Gbps maximum 
Port Speeds Redundant Power Supplies Hypervisor Licenses, network 
connectivity to internet or Cloud infrastructure 
Line Item # Section G Data transfer allowed per month MONTHLY 
rate 
Additional resources Po 
130 1 Virtual CPU 450.00 
126 1GB RAM 220.00 
127 Storage in minimum block of 50 GB 243.00 
128 Additional network segment (per VLAN) Ft 
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Additional 1 


IP 


Additional 1 sub-admin account 


MSP Charges 


131 MSP Charges 5% 

Line ltem#  Sec-A Line Items DC-Public Cloud 2 year DR-Public Cloud 2 year DC+DR-Public Cloud 2 year 
ak VM cpu RAM __ Storage (GB) HOURLY MONTHLY | HOURLY MONTHLY HOURLY MONTHLY 
rate rate rate rate rate rate 
2 Pack 1 1 1 50 25: 1730.0 233 1550.0 15.2 10472.8 
3 Pack 2 1 2 100 3.0 2060.0 2.7 1850.0 19.0 12638.8 
mz, Pack 3 2 4 100 शिळ 4120.0 5.4 3700.0 31.4 14774.4 
5 Pack 4 2 | 8 150 ms 5440.0 7.2 4900.0 41.0 20641.6 
Li Pack 5 2 16 150 12.0 8080.0 10.8 7300.0 44.0 29727.4 
7 Pack 6 4 4 200 10.0 6920.0 me 6200.0 a 47315.7 
शिक Pack 7 4 | 8] 250 12.0 8240.0 10.8 7400.0 mae 48412.0 
fT Pack 8 4 16 250 16.0 10880.0 14.4 9800.0 71.3 34819.4 
10 Pack 9 6 ।_6| 300 15.0 10380.0 13.5 9300.0 135.0 92353.3 
11 Pack 10 | 12 350 18.0 12360.0 16.2 11100.0 137.0 93436.3 
12 Pack 11 ee 4 400 20.0 13840.0 18.0 12400.0 137.0 94519.3 
13 Pack 12 a 16 450 24.0 16480.0 21.6 14800.0 137.0 95602.3 
14 = Pack 13 Es 32 450 32.0 21760.0 28.8 19600.0 127.7 62591.7 
15 Pack 14 12 12 500 30.0 20760.0 27.0 18600.0 260.4 162500.7 
16 Pack 15 12 24 550 36.0 24720.0 32.4 22200.0 262.6 163830.1 
17 Pack 16 16 16 mm 40.0 27680.0 36.0 24800.0 264.7 165159.4 
18 Pack 17 16 32 650 48.0 32960.0 43.2 29600.0 266.8 166488.8 
19 Pack 18 32 64 700 | | 65920.0 86.4 59200.0 575.7 359245.1 
20 Pack 19 64 128 750 192.0 131840.0 172.8 118400.0 1081.8 675064.6 
21 Pack20 128 256 800 2517.5 1314756.3 2517.5 1314756.3 5035.0 2629512.6 

22 Bandwidth-Plan 1- upto 100 GB 754.00 

23 Bandwidth-Plan 2- upto 500 GB 3,927.00 

24 Bandwidth-Plan 3- upto 1000 GB 8,000.00 

25 Additional data transfer tariff per GB 8.00 

Virtual Private Cloud 
Line Item Sec-A Line Items 


# 
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1 VM — cpu RAM — Storage (GB) = HOURLY rate MONTHLY HOURLY rate MONTHL HOURLY rate =MONTHL 
rate Y rate Y rate 
2 Pack 1 1 1 50 10.00 6,621.00 10.00 7231.00 20.00 13852.00 
3 Pack 2 1 2 100 10.00 6,830.00 10.00 7421.00 21.00 14251.00 
4 Pack 3 2 4 100 16.00 11,569.00 16.00 13267.00 35.00 24836.00 
5 Pack 4 2 | = 150 21.00 14,596.00 21.00 14359.00 41.00  28955.00 
| S| Pack 5 2 16 150 21.00 14,830.00 21.00 16159.00 44.00 30989.00 
7 Pack 6 4 4 200 32.00 23,081.00 32.00  26484.00 69.00 49565.00 
LS Pack 7 4 | = 250 32.00 23,081.00 32.00  26484.00 69.00 49565.00 
| | Pack 8 4 16 250 36.00 25,753.00 36.00  25678.00 69.00 51431.00 
10 Pack 9 किं | 300 63.00 45,505.00 63.00 52412.00 72.00 97917.00 
11. ?30९10 त्र्यं 12 350 64.00 46,020.00 64.00 52879.00 137.00 98899.00 
12 ?30९11 | | 400 64.00 46,020.00 64.00 52879.00 137.00 98899.00 
13 Pack 12 | = 16 450 64.00 46,020.00 64.00  52879.00 137.00 98899.00 
14. Pack 13 णि 32 450 71.00 51,407.00 71.00 56240.00 149.00 107647.0 
४] 
15. Pack 14 12 12 500 124.00 90,372.00 124.00 104236.0 267.00 194608.0 
8 ५] 
16 ?30९15 12 24 550 125.00 90,616.00 125.00  104459.0 269.00 195075.0 
0) (0) 
17. Pack 16 16 16 | 125.00 88,768.00 125.00 104649.0 269.00 193417.0 
(0) (0) 
18 Pack 17 16 32 650 125.00 90,824.00 125.00 104649.0 269.00 195473.0 
(0) 0) 
19 Pack 18 32 64 700 276.00 201,235.00 276.00  220973.0 579.00  422208.0 
0 ५] 
20 72२3930९19 64 128 750 550.00 400,808.00 550.00 440429.0 1154.00 841237.0 
५] 0) 
21 730९20 128 256 800 | दणी) P| Lo । ie Fe ee 
22 Bandwidth-Plan 1- upto 100 GB 754.00 
23 Bandwidth-Plan 2- upto 500 GB 3,927.00 
24 Bandwidth-Plan 3- upto 1000 GB 8,083.00 
25 Additional data transfer tariff per GB 8.00 
Line Item # SEC- B Line Items HOURLY MONTHLY 
STORAGE rate rate 
26 Object storage 50 GB ia 
125.00 
27 500 GB a 
737.00 
28 1000 GB a 
1,398.00 
29 10 TB om 
13,613.00 
30 File storage 50 GB शि 
141.00 
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31 500 GB 0.00 
1,406.00 

32 1000 GB a 
2,813.00 

33 10 TB a 
25,571.00 

34 Archive storage 50 GB ia 
117.00 

35 500 GB a 
698.00 

36 1000 GB शि 
978.00 

37 1018 | 
8,258.00 

38 DISK storage 50 GB <= 120 IOPS aa 
125.00 

39 121 to 400 IOPS | 
243.00 

1 *| 401 to 800 IOPS शं 
625.00 

41 801 to 1200 | | 
IOPS 800.00 

42 1201 to 2000 a 
IOPS 1,125.00 

43 > 5000 IOPS ei 
2,000.00 

44 500 GB <= 120 IOPS i 
1,250.00 

45 121 to 400 IOPS ma 
1,696.00 

46 401 to 800 IOPS I 
1,696.00 

47 801 to 1200 mu 
IOPS 1,808.00 

1 * 1201 (0 2000 | | 
1025 1,944.00 

49 > 5000 IOPS | | 
7,727.00 

50 1000 GB <= 120 IOPS शि 
2,500.00 

51 121 to 400 IOPS ima 
3,212.00 

52 401 to 800 IOPS a 
3,212.00 

53 801 to 1200 श्व 
IOPS 3,392.00 

ma; 1201 to 2000 ao 
IOPS 3,616.00 

55 > 5000 IOPS a 
8,035.00 

शा 10 TB <= 120 IOPS 0.00 
25,000.00 
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57 121 to 400 IOPS ial 
29,828.00 
58 401 to 800 IOPS | 
29,828.00 
59 801 to 1200 is 
1025 29,828.00 
1 *| 1201 (0 2000 i 
1025 29,828.00 
61 > 5000 IOPS शि 
44,011.00 
Line Item # SEC-C Database Options No. of Licenses required HOURLY MONTHLY 
DATABASE rate rate 
62 Postgre Enterprise 4 a 
शिका 5 (08 शिंगं 
शिका >8 | 
65 MySQL 4 socket, 8 socket, 16 socket and 32 socket 4 socket 
11,826.00 
1 *| 8 socket 
23,645.00 
67 16 socket 
47,290.00 
शिका 32 socket 
94,572.00 
8 MySQL Standard 4 ie 
70 5to8 ea 
71 >8 i 
72 MySQL Enterprise 4 om 
73 5to8 om 
74 >8 a 
75 MSSQL 2012 Standard Oo *। a 
21,976.00 
76 5 [08 a 
43,952.00 
77 >8 om 
87,904.00 
78 MSSQL 2012 Enterprise शिका | 
84,270.00 
79 5to8 a 
168,540.00 
| *। >8 शि 


337,080.00 
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81 Oracle Standard 4 a 
82 5to8 a 
83 >8 a 
ae Oracle Enterprise 4 a) 
85 5to8 a 
4 >8 शि 
87 NoSQL Enterprise 100 | 
88 101 to 500 शि 
a 501 to 1000 | 
शिका > 1000 me 
91 IBM DB2 v 10.5 or above 2 शिक 
92 4 um 
93 10 शबि 
तड >10 | 
शि NoSQL DB 100 | 
शिक 101 to 500 a 
97 501 to 1000 um 
aa > 1000 aa 
a, MySQL & Postgre SQL compatible relational database 4 a 
100 5to8 me 
101 >8 a 

SEC-D Media transcoding at 99.9% HOURLY MONTHLY 

availibility AMT AMT 

Quality Multiplier 

102 SD(1280X720) 1X per out put | 

minute 2.98 
103 HD (1280 x 720-1920 x 1080 2X per out put ia 


minute 


5.29 
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104 UHD (more than 1920 x 1080, up 4x per out put शि 
to 4096 x 2160) minute 10.06 

105 Audio only output 0.25X per out put शि 
minute 2.98 
Line Item # SEC-E SERVICES HOURLY MONTHLY 
rate rate 

106 Scalability Virtual Machine Scale Sets/Auto Scaling 1 unit of 5 VMs 0.00 

107 DNS DNS Management 1 शि 
2,975.00 

108 १0 Active Directory Services 1 a 
5,000.00 

109 VPN VPN/Gateway SITE to SITE point to point 2 ports per VPN शि 
4,000.00 

110 API Gateway/ Million API calls 1 i] 
Management 332.50 

111 Email/SMS Email gateway Per year cost for षि 
1 account with 60.00 

10GB 

112 SMS gateway 1 lakh sms per a 
month 17,000.00 

113 Public IP Additional public IP Addresses 1 ia 
125.00 

114 DASHBOARDS Network Monitoring dash Board 1 i] 
1,000.00 

115 BACKUP 830९५ agent , Backup management and monitoring , Back up 1 i 
Services Restoration 1,322.00 

116 DATA Bulk Data Transfer 118 शि 
TRANSFER 7,931.55 

117 DATA SYNC service 118 शि 
5,000.00 

118 Developer Tools & SDKs or equivalent 1 instance a 
Tools 16,525.00 

119 Code Deploy and commit tools or equivalent 1 instance a 
95.00 

120 Mobile Mobile Hub or equivalent 1 i 
Services 93,936.00 

121 Mobile SDK 1 i 

122 Container /Registry cl 4 
3,305.00 
124 Office 365(Email Service with 100 GB Mail Box each for primary and archival, 1 Zz शां 

Multiparty Video conferencing on PC, Laptop and tablets, personal data storage 
sync from PC to cloud, office productivity , search capabilities) or equivalent 
Line Item # SEC- F Bare Metal Servers 

HOURLY MONTHLY 
rate rate 

125 Intel Xeon E7-8890 v4 (192 Cores, 2.20 GHz),8192GB RAM (8192GB maximum), 1 हग 
Up to 29 Internal Hard Drives Up to 106005 maximum Port Speeds, Redundant 1,174,281.89 
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Power Supplies, Hypervisor Licenses, network connectivity to internet or Cloud 
infrastructure 
126 Quad Intel Xeon E7-4890 v2 (60 Cores, 2.80 GHz) 2048GB RAM (2048GB 1 शि 
maximum) Up to 24 Internal Hard Drives Up to 10Gbps maximum Port Speeds 391,427.30 
Redundant Power Supplies Hypervisor Licenses, network connectivity to 
internet or Cloud infrastructure 
127 Intel Xeon E5-2690 v4, Dual Intel Xeon E5-2690 v4 (28 Cores, 2.60 GHz) 256GB 1 0.00 
RAM (256GB maximum) Up to 2 Internal Hard Drives Up to 10Gbps maximum 88,071.14 
Port Speeds Redundant Power Supplies Hypervisor Licenses, network 
connectivity to internet or Cloud infrastructure 
Section G Data transfer allowed per month 
Line Item # HOURLY MONTHLY 
rate rate 
Additional resources al 
128 1 Virtual CPU | | 
500.00 
129 1068 RAM | | 
50.00 
130 Storage in minimum block of 50 शिंगे 
GB 10.00 
131 Additional network segment (per शि 
VLAN) 100.00 
132 Additional 1 IP | | 
125.00 
133 Additional 1 sub-admin account | | 
500.00 
134 MSP Charges 5% 
Line Item Sec-A Line Items DC-Virtual Public Cloud 2 DR-Virtual Public Cloud 2 year DC+DR-Virtual Public Cloud 2 year 
# year 
1 VM | RA Storage HOURLY rate MONTHLY HOURLY MONTHLY rate HOURLY rate MONTHLY rate 
M (GB) rate rate 
2 Pack 1 1 1 50 10.00 6,621.00 10.00 7,231.00 20 13852 
3 Pack 2 1 2 100 10.00 6,830.00 10.00 7,421.00 21 14251 
4 Pack 3 2 4 100 16.00 11,569.00 16.00 13,267.00 35 24836 
5 Pack 4 2 it 150 21.00 14,596.00 21.00 14,359.00 41 28955 
az, Pack 5 2 16 150 21.00 14,830.00 21.00 16,159.00 44 30989 
7 Pack 6 4 4 200 32.00 23,081.00 32.00 26,484.00 शिका 49565 
|, की Pack 7 4 चिंब 250 32.00 23,081.00 32.00 26,484.00 | 49565 
| Pack 8 4 16 250 36.00 25,753.00 36.00 25,678.00 72 51431 
10 Pack 9 | 8 | | 300 63.00 45,505.00 63.00 52,412.00 135 97917 
11 Pack हिं 12 350 64.00 46,020.00 64.00 52,879.00 137 98899 
10 
12 Pack i हिं 400 64.00 46,020.00 64.00 52,879.00 137 98899 
11 
13 Pack || 16 450 64.00 46,020.00 64.00 52,879.00 137 98899 
12 
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14 Pack 8 32 450 71.00 51,407.00 71.00 56,240.00 149 107647 
13 
15 Pack 12 12 500 124.00 90,372.00 124.00 104,236.00 267 194608 
14 
16 Pack 12 24 550 125.00 90,616.00 125.00 104,459.00 269 195075 
15 
17 Pack 16 16 शि 125.00 88,768.00 125.00 104,649.00 269 193417 
16 
18 Pack 16 32 650 125.00 90,824.00 125.00 104,649.00 269 195473 
17 
19 Pack 32 64 700 276.00 201,235.00 276.00 220,973.00 579 422208 
18 
20 Pack 64 128 750 550.00 400,808.00 550.00 440,429.00 1154 841237 
19 
21 Pack 12 256 800 1 ती शिळ शा शिक 
20 8 शिक शिश 
22 Bandwidth-Plan 1- upto 100 GB 754.00 
23 Bandwidth-Plan 2- upto 500 GB 3,927.00 
24 Bandwidth-Plan 3- upto 1000 GB 8,083.00 
25 Additional data transfer tariff per 
GB 8.00 
Government Community Cloud 
Line Sec-A Line Items DC-Government Community Cloud DR-Government DC+DR-Government 
Item # 1 year Community Cloud 1 Community Cloud 1 year 
year 
1 VM cpu RAM Storage (GB) HOURLY rate MONTHLY HOURL MONTHL ~~ HOURL MONTHLY rate 
rate Y rate Y rate Y rate 
2 Pack 1 1 1 50 14.00 
9,269.40 14.00 10,123.4 28.00 19,392.80 
0 
3 Pack 2 1 2 100 14.00 
9,562.00 15.40 10,389.4 29.40 19,951.40 
५] 
Pack 3 2 4 100 22.40 
16,196.60 26.60 18,573.8 49.00 34,770.40 
0) 
5 Pack 4 2 | 150 29.40 
20,434.40 28.00 20,102.6 57.40 40,537.00 
0) 
शि Pack 5 2 16 150 29.40 
20,762.00 32.20 22,622.6 61.60 43,384.60 
6) 
7 Pack 6 4 4 200 44.80 
32,313.40 51.80 37,077.6 96.60 69,391.00 
0) 
दिं Pack 7 4 | 250 44.80 
32,313.40 51.80 37,077.86 96.60 69,391.00 
0) 
| Pack 8 4 16 250 50.40 
36,054.20 50.40 35,949.2 100.80 72,003.40 
१] 
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10 Pack 9 शती शि 300 88.20 
63,707.00 100.80 73,376.8 189.00 137,083.80 
५] 
11 Pack 10 शि 12 350 89.60 
64,428.00 102.20 74,030.6 191.80 138,458.60 
0 
12 Pack 11 शि i 400 89.60 
64,428.00 102.20 74,030.6 191.80 138,458.60 
0 
13 Pack 12 क 16 450 89.60 
64,428.00 102.20 74,030.6 191.80 138,458.60 
५] 
14 Pack 13 a 32 450 99.40 
71,969.80 109.20 78,736.0 208.60 150,705.80 
0 
15 Pack 14 12 12 500 173.60 
126,520.80 200.20 145,930. 373.80 272,451.20 
40 
16 Pack 15 12 24 550 175.00 
126,862.40 201.60 146,242. 376.60 273,105.00 
60 
17 Pack 16 16 16 चा 175.00 
124,275.20 244.80 146,508. 457.30 270,783.80 
60 
18 Pack 17 16 32 650 175.00 
127,153.60 201.60 146,508. 376.60 273,662.20 
60 
19 Pack 18 32 64 700 386.40 
281,729.00 424.20 309,362. 810.60 591,091.20 
20 
20 Pack 19 64 128 750 770.00 
561,131.20 845.60 748,729. 1,615.6 1,177,731.80 
30 0) 
21 Pack 20 128 256 800 oe 
22 Bandwidth-Plan 1- upto 100 GB 
754.00 
23 Bandwidth-Plan 2- upto 500 GB 
3,927.00 
24 Bandwidth-Plan 3- upto 1000 GB 
8,083.00 
25 Additional data transfer tariff per GB 
8.00 
Line SEC- B Line Items MONTHLY 
Item# = STORAG HOURLY rate 
E rate 
26 Object storage 50GB 
a 125.00 
27 500 GB 
- | 737.00 
28 1000 GB 
| 1,398.00 
29 10 TB 
पां 13,613.00 
30 File storage 50 GB 
- | 141.00 
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31 500 GB 
1,406.00 
32 1000 GB 
2,813.00 
33 10 TB 
25,571.00 
34 Archive storage 50 GB 
117.00 
35 500 GB 
698.00 
36 1000 GB 
978.00 
37 10 TB 
8,258.00 
38 DISK storage 50GB <= 120 IOPS 
125.00 
39 121 to 400 
IOPS 243.00 
शि 401 to 800 
IOPS 625.00 
41 801 to 1200 
IOPS 800.00 
42 1201 to 
2000 IOPS 1,125.00 
43 > 5000 IOPS 
2,000.00 
| 500 68 <= 120 ॥0?5 
1,250.00 
45 121 to 400 
1025 1,696.00 
46 401 to 800 
IOPS 1,696.00 
47 801 to 1200 
IOPS 1,808.00 
48 1201 to 
2000 IOPS 1,944.00 
i > 5000 IOPS 
7,727.00 
50 100068 <=12010PS 
1,662.60 
51 121 to 400 
IOPS 3,212.00 
52 401 to 800 
IOPS 3,212.00 
53 801 to 1200 
IOPS 3,392.00 
54 1201 to 
2000 IOPS 3,616.00 
55 > 5000 IOPS 
8,035.00 
56 10 TB <= 120 IOPS 
25,000.00 
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57 121 to 400 
IOPS a 29,828.00 
58 401 to 800 
IOPS = 29,828.00 
59 801 to 1200 
IOPS E | 29,828.00 
ia 1201 to 
2000 IOPS | 29,828.00 
61 > 5000 IOPS 
a 44,011.00 
Line SEC-C Database Options No. of Licenses required HOURLY MONTHLY 
Item # DATABA rate rate 
SE 
62 Postgre Enterprise 4 
63 5to8 
a >8 
65 MySQL 4 socket, 8 socket, 16 socket 4 socket 
and 32 socket 16,556.40 
al 8 socket 
33,103.00 
67 16 
socket 66,206.00 
शि 32 
socket 132,400.80 
a MySQL Standard 4 
70 5to8 
71 >8 
72 MySQL Enterprise 4 
73 5to8 
74 >8 
75 MSSQL 2012 Standard 4 
त्या 21,976.00 
76 5 to8 
a 43,952.00 
77 >8 
| 87,904.00 
78 MSSQL 2012 Enterprise 4 
- | 84,270.00 
79 5to8 
m7 168,540.00 
a >8 
El 337,080.00 
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81 Oracle Standard 4 
82 5 (08 
83 >8 
4 Oracle Enterprise 4 
85 5to8 
a >8 
87 NoSQL Enterprise 100 
88 101 to 

500 ७ | का 
1 501 to 

1000 - | शिका 
शि >1000 
91 IBM DB2 v 10.5 or above 2 
92 4 
| 10 
पिंग >10 
95 NoSQL DB 100 
शि 101 to 

500 | - | 
97 501 to 

1000 | शिका 
शि >1000 
शि MySQL & Postgre SQL compatible 4 

relational database - | 
100 5to8 
101 >8 
SEC-D Media transcoding at 99.9% Multipli HOURLY MONTHLY 
availability er AMT AMT 
Quality 
102 SD(1280X720) 1X per output 
minute 7 4.17 
103 HD (1280 x 720-1920 x 2X per output 
1080 minute - | 741 
104 UHD (more than 1920 x 4x per output 
1080, up to 4096 x 2160) minute iz 13.89 
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GHz),8192GB RAM (8192GB maximum), Up to 29 
Internal Hard Drives Up to 10Gbps maximum Port 
Speeds, Redundant Power Supplies, Hypervisor 
Licenses, network connectivity to internet or Cloud 
infrastructure 


105 Audio only output 0.25X per output 
minute - 4.17 
Line SEC-E SERVICES HOURLY MONTHLY 
Item # rate rate 
106 Scalabilit | Virtual Machine Scale Sets/Auto Scaling 1 unit of 5 
y VMs aa - 
107 DNS DNS Management 1 
a 2,975.00 
108 AD Active Directory Services 1 
a 5,000.00 
109 VPN VPN/Gateway SITE to SITE point to 2 ports per 
point VPN a) 4,000.00 
110 API Million API calls 1 
Gateway a 258,648.60 
/ 
Manage 
ment 
111 Email/S Email gateway Per year cost 
MS for 1 | 60.00 
account with 
10 GB 
112 SMS gateway 1 lakh sms 
per month a 17,000.00 
113 Public IP = Additional public IP Addresses 1 
ति 150.00 
114 DASHBO Network Monitoring dash Board 1 
ARDS ख्रि 1,000.00 
115 BACKUP 830९५७ agent , Backup management 1 
Services and monitoring , Back up Restoration a 1,322.00 
116 DATA Bulk Data Transfer 118 
TRANSFE ma 10,000.00 
R 
117 DATA SYNC service 118 
णि 5,000.00 
118 Develop Tools & SDKs or equivalent 1 instance 
er Tools Pl 23,135.00 
119 Code Deploy and commit tools or 1 instance 
equivalent aa 23,135.00 
120 Mobile Mobile Hub or equivalent 1 
Services ee 28,092.50 
121 Mobile SDK 1 
122 Container /Registry 1 
7 4,627.00 
123 Office 365(Email Service with 100 GB Mail Box each 1 - 
for primary and archival, Multiparty Video - 
conferencing on PC, Laptop and tablets, personal 
data storage sync from PC to cloud, office 
productivity , search capabilities) or equivalent 
Line SEC- F Bare Metal Servers HOURLY MONTHLY 
Item # rate rate 
124 Intel Xeon E7-8890 v4 (192 Cores, 2.20 1 


1,174,281.89 


Government Circular No.: मातंसं - 060/3/2017/1 


125 Quad Intel Xeon E7-4890 v2 (60 Cores, 2.80 GHz) 1 
2048GB RAM (2048GB maximum) Up to 24 Internal a 391,427.30 
Hard Drives Up to 10Gbps maximum Port Speeds 
Redundant Power Supplies Hypervisor Licenses, 
network connectivity to internet or Cloud 
infrastructure 
126 Intel Xeon E5-2690 v4, Dual Intel Xeon E5-2690 v4 1 
(28 Cores, 2.60 GHz) 256GB RAM (256GB a 88,071.14 
maximum) Up to 2 Internal Hard Drives Up to 
10Gbps maximum Port Speeds Redundant Power 
Supplies Hypervisor Licenses, network connectivity 
to internet or Cloud infrastructure 
Line Section MONTHLY 
Item # G HOURLY rate 
rate 
Additional resources 
127 1 Virtual CPU 
- | 500.00 
128 1 GB RAM 
७ | 50.00 
129 Storage in minimum block 
of 50 GB षा 10.00 
130 Additional network 
segment (per VLAN) a 100.00 
131 Additional 1 IP 
शा 125.00 
132 Additional 1 sub-admin 
account - | 500.00 
133 MSP 5% 
Charges 
Line Item # Sec-A Line Items DC-Government Community Cloud §DR-Government Community Cloud DC+DR-Government Community 
2 year 2 year Cloud 2 year 
1 VM cpu RAM Storage HOURLY rate MONTHLY HOURLY rate MONTHLY rate HOURLY rate MONTHLY rate 
(GB) rate 
2 Pack 1 1 1 50 14 9269.4 14.00 10,123.40 28.00 19,392.80 
3 Pack 2 1 2 100 14 9562 15.40 10,389.40 29.40 19,951.40 
4 Pack 3 2 4 100 22.4 16196.6 26.60 18,573.80 49.00 34,770.40 
5 Pack 4 2 8 150 29.4 20434.4 28.00 20,102.60 57.40 40,537.00 
शिक Pack 5 2 16 150 29.4 20762 32.20 22,622.60 61.60 43,384.60 
7 Pack 6 4 4 200 44.8 32313.4 51.80 37,077.60 96.60 69,391.00 
| 8 Pack 7 4 दिलं 250 44.8 32313.4 51.80 37,077.60 96.60 69,391.00 
| 4 Pack 8 4 16 250 50.4 36054.2 50.40 35,949.20 100.80 72,003.40 
10 Pack 9 | hoe 300 88.2 63707 100.80 73,376.80 189.00 137,083.80 
11. Pack 10 षि 12 350 89.6 64428 102.20 74,030.60 191.80 138,458.60 
12 Pack 11 | 8| x 400 89.6 64428 102.20 74,030.60 191.80 138,458.60 
13 Pack 12 he 16 450 89.6 64428 102.20 74,030.60 191.80 138,458.60 
14. Pack 13 | 8| 32 450 99.4 71969.8 109.20 78,736.00 208.60 150,705.80 
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15 Pack 14 12 12 500 173.6 126520.8 200.20 145,930.40 373.80 272,451.20 
16 Pack 15 12 24 550 175 126862.4 201.60 146,242.60 376.60 273,105.00 
17 Pack 16 16 16 me 175 124275.2 244.80 146,508.60 457.30 270,783.80 
18 = Pack 17 16 32 650 175 127153.6 201.60 146,508.60 376.60 273,662.20 
19 Pack 18 32 64 700 386.4 281729 424.20 309,362.20 810.60 591,091.20 
20 Pack 19 64 128 750 770 561131.2 845.60 748,729.30 1,615.60 1,177,731.80 
21 Pack20 128 256 800 CS eS 1 7| Po P| LC 
22 Bandwidth-Plan 1- upto 100 GB 754.00 
23 Bandwidth-Plan 2- upto 500 GB 3,927.00 
24 Bandwidth-Plan 3- upto 1000 GB 8,083.00 
25 Additional data transfer tariff per GB 8.00 
FOR CENTOS ONLY 


Rates for other line items not available on centos 


Public Cloud 
DC-Public Cloud DR-Public Cloud 1 DC+DR-Public _DC-Public Cloud 2 DR-Public Cloud 2 DC+DR-Public 
1 year year Cloud 1 year year year Cloud 2 year 
Line Sec-A Line Items Only for CentOS Only for CentOS Only for CentOS Only for CentOS Only for CentOS Only for CentOS 
Item # 

VM c RA Stor HOU MONT HOURL MONT HOURL MONT HOUR MONTHL HOURL MONT HOURL MONT 

p M age RLY HLY Y rate HLY Y rate HLY LY Y Y rate HLY Y rate HLY 

uU (GB) rate rate rate rate rate rate rate rate 

1 Pack 1 1 50 2.5 1800.0 2.3 1626.0 12.3. 7355.0 2.5 1730.0 2.3. 1550.0 12.3 7355.0 
ali 

2 Pack 1 2 100 3.0 2160.0 2.7 1956.0 14.7. 8810.0 3.0 2060.0 2.7. 1850.0 14.7 8810.0 
2 

3 Pack 2 4 100 Ee 4320.0 5.4 3912.0 18.3 10970. EZ 4120.0 5.4 3700.0 18.3 10970. 

3 0 0 

| 4 Pack 2 i 150 पिं 5760.0 7.2 5232.0 23.9 14315. Ey 5440.0 7.2 4900.0 23.9 14315. 

4 0 0 

5 Pack 2 16 150 12.0 8640.0 10.8 7872.0 32.3 । 19355. 12.0 8080.0 10.8 7300.0 32.3 19355. 

5 0 0 

, Pack 4 4 200 10.0 6760.0 | | 6504.0 24.0 14420. 10.0 6760.0 | 8° 6200.0 24.0 14420. 

6 0 0 

7 Pack 4 [| 250 12.0 8370.0 10.8 7824.0 29.6 17765. 12.0 8240.0 10.8 7400.0 29.6 17765. 

7 0) 0 

| 8 Pack 4 16 250 16.0 10890. 144 10464. 38.0 22805. 16.0 10880.0 14.4 9800.0 38.0 22805. 

8 0 0 0 0 

zz Pack | |e 300 15.0 8990.0 13.5 9756.0 31.9 19130. 15.0 8990.0 13.5 9300.0 31.9 19130. 

9 0 0 

10 Pack eS 12 350 18.0 11230. 16.2 11736. 39.6 23735. 18.0 11230.0 16.2 11100. 39.6 23735. 

10 0 0 0 0 0 

11 Pack | | | 400 18.7. 11220. 18.0 12620. 39.7 23840. 18.7 11220.0 18.0 12400. 39.7 23840. 

11 0 0 0 0 0 

12 Pack दिं 16 450 23.5 14090. 21.6 15615. 49.5 29705. 23.5 14090.0 21.6 14800. 49.5 29705. 

12 0 0 0 0 0 

13 Pack a 32 450 31.9 19130. 28.8 20655. 66.3 39785. 31.9 19130.0 28.8 19600. 66.3 39785. 

13 0 0 0 0 0 

14 Pack 1 12 500 25.0 14980. 27.0 16630. 52.7 31610. 25.0 14980.0 27.0 16630. 52.7 31610. 

14 2 0 0 0 (0) 0 

15 Pack 1 24 550 31.9 19110. 32.4 20885. 66.7 39995. 31.9 19110.0 32.4 20885. 66.7 39995. 

15 2 0 0 0 0 0 

16 Pack 1 16 ie 31.2 18740. 34.4 20640. 65.6 39380. 31.2 18740.0 34.4 20640. 65.6 39380. 

16 6 0 0 0 0 0 

17 Pack 1 32 650 40.2 24130. 43.2 26155. 83.8 50285. 40.2 24130.0 43.2 | 26155. 83.8 50285. 

17 6 0 0 0 ५] 0 

18 Pack 3 64 700 | 6| 41760. 73.2 43910. 142.8 85670. fi 41760.0 73.2 । 43910. 142.8 85670. 

18 2 0 0 0 0 0 

19 Pack 6 12 750 127.8 76670. 131.6 78945. 259.6 15561 127.8 76670.0 131.6 78945. 259.6 15561 

19 4 8 0 0 5.0 0) 5.0 
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20 Pack 1 25 800 243.6 146140 247.6 148540 491.1 29468 243.6  146140.0 247.6 148540 491.1 29468 
20 2 6 0 .0 0.0 0 0.0 
8 
VIRTUAL PRIVATE Cloud 
DC-VIRTUAL DR-VIRTUAL DC+DR-VIRTUAL DC-VIRTUAL DR-VIRTUAL DC+DR Virtual 
Private Cloud 1 Private Cloud 1 Private Cloud 1 Private Cloud 2 Private Cloud 2 Private Cloud 1 
year year year year year year 
Line Sec-A Line Items Only for CentOS Only for CentOS Only for CentOS Only for CentOS Only for CentOS Only for CentOS 
Item # 
VM c RA __ Stor HOU MONT ~~ HOURL MONT HOURL MONT HOUR MONTHL  HOURL MONT HOURL MONT 
p M age RLY HLY Y rate HLY Y rate HLY LY Y rate Y rate HLY Y rate HLY 
u (GB) rate rate rate rate rate rate rate 
1 Pac 1 1 50 8.70 5200.0 10.00 5725.0 18.21 10925. 8.70 5200.00 10.00 5725.0 18.21 10925 
1 ५] 6) 00 0) 
2 Pac 1 2 100 10.09 6050.0 10.00 6700.0 21.00 12750. 10.00 6050.00 10.00 6700.0 21 12750 
2 6) 6) 00 0) 
3 Pac 2 4 100 12.30 7400.0 13.00 8050.0 25-75 15450. 12.30 7400.00 13.00 8050.0 25.75 15450 
3 6) 0 00 6) 
4 Pac 2 | 150 = 15.80 9450.0 17.00 10225. 32.79 19675. 15.80 9450.00 17.00 10225. 32.79 19675 
4 0 00 00 00 
5 Pac 2 16 150 21.00 12650. 21.00 13425. 43.46 26075. 21.00  12650.00 21.00 13425. 43.46 26075 
5 00 00 00 00 
Ls Pac 4 4 200 15.70 9400.0 17.00 10300. 32.83 19700. 15.70 9400.00 17.00 10300. 32.83 19700 
6 0 00 00 00 
7 Pac 4 | 8 250 19.10 11450. 21.00 12475. 39.88 23925. 19.10  11450.00 21.00 12475. 39.88 23925 
7 00 00 00 00 
शिळ Pac 4 16 250 24.40 14650. 26.00 15675. 50.54 30325. 24.40  14650.00 26.00 15675. 50.54 30325 
8 00 00 00 00 
| I Pac | | 8 300 20.30 12200. 22.00 13350. 42.58 | 25550. 20.30  12200.00 22.00 13350. 42.58 25550 
9 00 00 00 00 
10 Pac | &| 12 350 25.10 15050. 27.00 16325. 52.29 | 31375. 25.10  15050.00 27.00 16325. 52.29 31375 
10 00 00 00 00 
11 Pac हिं 8 400 25.00 15000. 27.00 16400. 52.33 31400. 25.00  15000.00 27.00 16400. 52.33 31400 
11 00 00 00 00 
12 Pac | 16 450 31.10 18650. 34.00 20175. 64.71 38825. 31.10  18650.00 34.00 20275. 64.71 38825 
12 00 00 00 00 
13 Pac | 32 450 41.80 25050. 44.00 26575. 86.04 51624. 41.80  25050.00 44.00 26575. 86.04 51624 
13 00 00 00 00 
14 Pac 1 12 500 32.80 19700. 36.00 21350. 68.42 41050. 32.80 19700.00 36.00 21350. 68.42 41050 
14 2 00 00 00 00 
15 Pac 1 24 550 46.10 24950. 45.00 26725. 86.13 51675. 46.10  24950.00 45.00 26725. 86.13 51675 
15 2 00 00 00 00 
16 Pac dl 16 ha 40.70 24400. 44.00 26300. 84.50 50700. 40.70  24400.00 44.00 26300. 84.5 50700 
16 6 00 00 00 00 
17 Pac 1 32 650 52.10 31250. 55.00 33275. 107.54 64525. 52.10 | 31250.00 55.00 33275. 107.54 64525 
17 6 00 00 00 00 
18 Pac 3 64 700 88.80 53300. 92.00 55450. 181.25 10875 88.80 53300.00 92.00 55450. 181.25 10875 
18 2 00 00 0.00 00 0 
19 Pac 6 12 750 161.6 96950. 165.00 99225. 326.96 19617 161.6 96950.00 165.00 99225. 326.96 19617 
19 4 8 ५] 00 00 5.00 0) 00 5 
20 Pac 1 25 800 | i a शि | शि | — “ 4 | | 
20 2 6 
8 
Government Community Cloud 
DC-GCC 1 year DR-GCC 1 year DC+DR-GCC 1 DC-GCC 2 year DR-GCC 2 year DC+DR-GCC 2 
year year 
a Sec-A Line Items Only for CentOS Only for CentOS Only for CentOS Only for CentOS Only for CentOS Only for CentOS 
Item # 
VM Cc RA Stor HOU MONT HOURL MONT HOURL MONT HOUR MONTHL HOURL MONT HOURL MONT 
p M age RLY HLY Y rate HLY Y rate HLY LY Y rate Y rate HLY Y rate HLY 
u (GB) rate rate rate rate rate rate rate 
1 Pack 1 1 50 12.3 7375 
1 12.30 7,375.0 13.00 7,950.0 25.54 15,325 13.00 7,950.0 25.54 | 15,325 
6) 0 .00 6) .00 
2 Pack 1 2 100 14 8500 
2 14.00 8,500.0 15.00 | 9,250.0 29.40 17,750 15.00 | 9,250.0 29.40 | 17,750 
6) 6) .00 १] .00 
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3 Pac 2 4 100 17.1 10250 
3 17.10 10,250. 19.00 11,100. 35.58 21,350 19.00 11,100. 35.58 21,350 
00 00 .00 00 .00 
शं Pac 2 a 150 215 12875 
4 21.50 12,875. 23.00 14,050. 44.88 26,925 23.00 14,050. 44.88 26,925 
00 00 .00 00 .00 
5 Pacl 2 16 150 28.1 16875 
5 28.10 16,875. 31.00 18,450. 58.88 35,325 31.00 18,450. 58.88 35,325 
00 00 .00 00 .00 
शि Pacl 4 4 200 21.7 13000 
6 21.70 13,000. 24.00 14,100. 45.17 27,100 24.00 14,100. 45.17 27,100 
00 00 .00 00 .00 
7 Pacl 4 wi 250 26 15625 
7 26.00 15,625. 28.00 17,050. 54.46 32,675 28.00 17,050. 54.46 32,675 
00 00 .00 00 .00 
Of Pacl 4 16 250 32.7 19625 
8 32.70 19,625. 36.00 21,450. 68.46 41,075 36.00 21,450. 68.46 41,075 
00 00 .00 00 .00 
शं Pack i a 300 27.9 16750 
9 27.90 16,750. 30.00 18,200. 58.25 34,950 30.00 18,200. 58.25 34,950 
00 00 .00 00 .00 
10 Pack i 12 350 34 20375 
10 34.00 20,375. 37.00 22,250. 71.04 42,625 37.00 22,250. 71.04 42,625 
00 00 .00 00 .00 
11 Pack - a 400 34.2 20500 
11 34.20 20,500. 37.00 22,300. 71.33 42,800 37.00 22,300. 71.33 42,800 
00 00 .00 00 .00 
12 Pack a 16 450 41.9 25125 
12 41.90 25,125. 46.00 27,450. 87.63 52,575 46.00 27,450. 87.63 52,575 
00 00 .00 00 .00 
13 Pack | 32 450 55.2 33125 
13 55.20 33,125. 60.00 36,250. 115.63 69,375 60.00 36,250. 115.63 69,375 
00 00 .00 00 .00 
14 Pack 1 12 500 44.6 26750 
14 2 44.60 26,750. 48.00 29,000. 92.92 55,750 48.00 29,000. 92.92 55,750 
00 00 .00 00 .00 
15 Pack 1 24 550 55.6 33375 
15 2 55.60 33,375. 61.00 36,300. 116.21 69,725 61.00 36,300. 116.21 69,725 
00 00 .00 00 .00 
16 Pac 1 16 शनि 55 33000 
16 6 55.00 33,000. 60.00 35,700. 114.50 68,700 60.00 35,700. 114.50 68,700 
00 00 .00 00 .00 
17 Pac 1 32 650 69.4 41625 
17 6 69.40 41,625. 75.00 45,250. 144.79 86,875 75.00 45,250. 144.79 86,875 
00 00 .00 00 .00 
18 Pac 3 64 700 117.1 70250 
18 2 117.1 70,250. 126.00 75,600. 243.08 145,85 126.00 75,600. 243.08 145,85 
0 00 00 0.00 00 0.00 
19 Pac 6 12 750 2115 126875 
19 4 8 211.55 126,87 226.00 135,55 437.38 262,42 226.00 135,55 437.38 262,42 
0 5.00 0.00 5.00 0.00 5.00 
20 Pac Al 25 800 399.2 239500 
20 2 6 399.2 239,50 425.00 254,70 823.67 494,20 425.00 254,70 823.67 494,20 
8 0 0.00 0.00 0.00 0.00 0.00 
Tier 2 Empanelment rate 
Public Cloud 
Public Cloud Virtual Private Cloud Government Community Cloud 
Li i Line Items DC-Public DR-Public DC+DR- DC-Virtual DR-Virtual DC+DR- DC-GCC 1 DR-GCC 1 DC+DR-GCC 
n -A Cloud 1 Cloud 1 Public Private Private Virtual year year 1 year 
e year year Cloud 1 Cloud 1 Cloud 1 Private 
It year year year Cloud 1 
e year 
m VM c R Sto HO MO HO MO HO MO HO MO HO MO HO MO HO MO HO MO HO MO 
# p A rag URL NTH URL NTH URL NTH URL NTH URL NTH URL NTH URL NTH URL NTH URL NTH 
u M oe Y Y Y ¥. Y Y 08 Y Y 
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(GB rat LY rat LY rat LY rat LY rat LY rat LY rat LY rat LY rat LY 
) e rate oe rate e rate e rate ९ rate oe rate oe rate  € rate  € rate 

a Pac | 1 | 1 50 8.1 5,90 8.1 5900 81 5900 8.2 590 8.2 590 8.2 590 8.2 590 8.2 590 8.2 590 
k1 9 0 9 .00 9 .00 0.0 0.0 0.0 0.0 0.0 0.0 

2 Pac 1 2 10 8.5 6,15 8.5 6150 8.5 6150 8.5 615 8.5 615 8.5 615 8.5 615 8.5 615 8.5 615 
k2 0 4 0 4 .00 4 .00 0.0 0.0 0.0 0.0 0.0 0.0 

7 Pac 2 4 | 10 8.9 6,45 8.9 6450 89 6450 [ee 645 8 | 645 re] 645 १0 | 645 8° | 645 | 645 
k3 0 6 0 6 .00 6 .00 0.0 0.0 0.0 0.0 0.0 0.0 

4 Pac 2 | 15 9.7 7,00 9.7 7000 9.7. 7000 9.7 700 9.7 700 9.7 700 9.7 700 9.7 700 9.7 700 
k4 0 2 0 2 .00 2 .00 0.0 0.0 0.0 0.0 0.0 0.0 

5 | Pac 2 1 15 10. 7,80 10. 7800 10. 7800 10. 780 10. 780 10 780 10 780 10. 780 10 780 
k5 6 0 83 0 83 .00 83 .00 8 0.0 8 0.0 8 0.0 8 0.0 8 0.0 8 0.0 

a Pac le चिं 20 10 7,45 10. 7450 10 7450 10. 745 10. 745 10. 745 10 745 10. 745 10. 745 
k6 0 35 0 35 .00 35 .00 4 0.0 4 0.0 4 0.0 4 0.0 4 0.0 4 0.0 

7 Pac 4 | | 25 11 8,00 11. 8000 11. 8000 11. 800 11. 800 11 800 11 800 11. 800 11 800 
k7 0 11 0 11 .00 11 .00 1 0.0 1 0.0 1 0.0 1 0.0 1 0.0 1 0.0 

7 Pac 4 | 1 25 12 8,80 12. 8800 12. 8800 12. 880 12. 880 12 880 12 880 12. 880 12 880 
k8 6 0 22 0 22 .00 22 .00 2 0.0 2 0.0 2 0.0 2 0.0 2 0.0 2 0.0 

9 Pac चि 6 30 14. 10,1 14 1015 14 1015 14. 101 14. 101 14 101 14 101 14. 101 14 101 
k9 0 i 50 10 0.00 10 000 1 50.0 1 50.0 1 50.0 1 50.0 1 50.0 1 50.0 

o Pac . 1 35 15. 10,9 15 1090 15 1090 15. 109 15. 109 15) 109 15 109 15. 109 15 109 

0 k 2 0 14 00 14 0.00 14 000 1 00.0 1 00.0 1 00.0 1 00.0 1 00.0 1 00.0 
10 

i Pac . 8 a 16. 11,6 16 1160 16 1160 16. 116 16. 116 16. 116 16 116 16. 116 16. 116 

1 k 0 11 00 11 0.00 11 000 1 00.0 1 00.0 1 00.0 1 00.0 1 00.0 1 00.0 
11 

EB Pac 7 1 45 17. 12,7 17 1270 17, 1270 17. 127 17. 127 17 127 17 127 17. 127 17 127 

2 k 6 0 64 00 64 0.00 64 0.00 6 00.0 6 00.0 6 00.0 6 00.0 6 00.0 6 00.0 
12 

a Pac 7 3 45 20. 14,7 20 1470 20 1470 20. 147 20. 147 20 147 20 147 20. 147 20 147 

3 k 2 0 42 00 42 0.00 42 0.000 4 00.0 4 00.0 4 00.0 4 00.0 4 00.0 4 00.0 
13 

छि Pac 1 1 50 17. 12,8 17 1280 17 1280 17. 128 17. 128 17 128 17 128 17. 128 17 128 

4 k 2 2 0 78 00 78 0.00 78 0.00 8 00.0 8 00.0 8 00.0 8 00.0 8 00.0 8 00.0 
14 

: Pac 1 2 55 20 14,4 20 1440 20 1440 20. 144 20. 144 20 144 20 144 20. 144 20. 144 

5 k 2 4 0 00 00 0.00 00 0.00 0 00.0 O 00.0 0 00.0 O 00.0 O 00.0 O 00.0 
15 

1 Pac 1 1 a 19, 14,0 19 1400 19 1400 19. 140 19. 140 19 140 19 140 19. 140 19 140 

6 k 6 6 0 44 00 44 0.00 44 0.000 4 00.0 4 00.0 4 00.0 4 00.0 4 00.0 4 00.0 
16 

1 Pac | 1 | 3 65 22. 16,1 22. 1610 22. 1610 22. 161 22. 161 22 161 22 161 22. 161 22 161 

7 k 6 2 0 36 00 36 0.00 36 000 4 00.0 4 00.0 4 00.0 4 00.0 4 00.0 4 00.0 
17 

क Pac 3 शि 70 55. 39,7 55 3971 55 3971 | 55. 397 55. 397 55 397 55 397 55. 397 55 397 

8 k 2/4 0 16 13 16 3.00 16 3.00 2 13.0 2 13.0 2 13.0 2 13.0 2 13.0 2 13.0 
18 

2 Pac शि 1 75 88. 63,8 88. 6381 88 6381 88. 638 88. 638 88 638 88 638 88. 638 88 638 

9 k 4 2 0 63 13 63 3.00 63 3.00 6 13.0 6 13.0 6 13.0 6 13.0 6 13.0 6 13.0 
19 8 

ति Pac 1 2 80 155 111, 155 | 1119 | 155 | 1119 |; 155 | 111 155 111 155 111 155 111 155 111 155 111 
k 2 5 0 .43 913 43 13.0 43 13.0 .4 913. 4 913. 4 913. 4 913. | 4 913. 4 913. 
20 8 6 0 0 0 0 0 0 0 0 

Fl Bandwidth-Plan 1- 800 

1 upto 100 GB 

2 Bandwidth-Plan 2- 4000 

2 upto 500 GB 

2 | Bandwidth-Plan 3- 8000 

3 upto 1000 GB 

2 | Additional data 

4 transfer tariff per GB 

Line  SEC-B Line Items Line | SEC-C Database No. of 

Item = STORAGE MONTHLY Item = DATABASE Options Licenses MONTHLY 

# rate # required rate 

25 Object storage 50 GB 100 61 Postgre Enterprise 4 3,412.00 

26 _। 500 GB 1000 62 508 3,412.00 

27 1000 68 2000 63 >8 3,412.00 
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28 
29 
30 
31 
32 
33 
34 
35 
36 
37 
38 
39 


59 
60 


Line Item # 


File storage 


Archive storage 


DISK storage 


105 


106 


107 


108 


SEC-E SERVICES 


Scalability 


DNS 


AD 


VPN 


10 TB 

50 GB 

500 GB 

1000 GB 

1018 

50 GB 

500 GB 

1000 GB 

1018 

50 GB <= 120 


OPS 


121 to 400 IOPS 


401 to 800 IOPS 


801 to 

1201 to 

> 5000 
500 GB <= 120 


200 IOPS 
2000 IOPS 
OPS 

OPS 


121 to 400 IOPS 


401 to 800 IOPS 


801 [01 
1201 to 
> 5000 
1000068  <=120 


121 [04 


200 IOPS 
2000 IOPS 
OPS 

OPS 

00 IOPS 


401 to 800 IOPS 


801 [01 

1201 to 

> 5000 
10 TB <= 120 


121 to 4 


200 IOPS 
2000 IOPS 
OPS 

OPS 


00 IOPS 


401 to 800 IOPS 


801 (01 


1201 to 


200 IOPS 
2000 IOPS 


> 5000 


Virtual Machine Scale Sets/Auto 


Scaling 
DNS Management 


price quoted is for per DNS 
entry 

Active Directory Services price 
quoted is for per User. 


VPN / Gateway 


OPS 


2 ports per VPN 


16000 
125 
1250 
2500 
20000 
75 
750 
1500 
12000 
100 
100 
100 
100 
300 
300 
1000 
1000 
1000 
1000 
3000 
3000 
2000 
2000 
2000 
2000 
6000 
6000 
6000 
6000 
6000 
6000 
48000 


48000 


1 unit of 5 VMs 


64 MySQL 4 socket, 8 socket, 
ae 16 socket and 32 socket 
66 

67 

68 MySQL Standard 

69 

70 

71 MySQL Enterprise 

72 

73 

74 MSSQL 2012 Standard 
7D 

76 

77 MSSQL 2012 Enterprise 
78 

79 

80 Oracle Standard 

81 

82 

83 Oracle Enterprise 

84 

85 

86 NoSQL Enterprise 

87 

88 

89 

90 IBM DB2 v 10.5 or above 
91 

92 

93 

94 NoSQL DB 

95 

96 

97 


98 MySQL & Postgre SQL 
compatible relational 


99 database 


100 


Price per Unit per 
Month if services 
taken for 1 year 


10 


75 


25 


300 


4 socket 
8 socket 
16 socket 


32 socket 


>8 

100 

101 to 500 
501 to 1000 
> 1000 

2 

4 

10 

>10 

100 

101 to 500 
501 to 1000 
> 1000 

4 

5 [08 


>8 


6,489.00 

5,948.00 

5,408.00 
16,222.00 
14,871.00 
13,519.00 

7,000.00 

7,000.00 

7,000.00 
27,000.00 
27,000.00 
27,000.00 
18,168.00 
18,168.00 
18,168.00 
27,043.00 
27,043.00 
27,043.00 
11,969.00 
11,969.00 
23,937.00 
47,874.00 
99,400.00 
99,400.00 
99,400.00 
99,400.00 
11,969.00 
11,969.00 
23,937.00 
47,874.00 

6,489.00 

5,948.00 

5,408.00 


Price per Unit per 
Month if services taken for 2 


years 


10 


75 


25 


300 
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Line Item # 


122 


123 


124 


Line Item # 


125 
126 
127 
128 
129 
130 
131 


109 


110 


111 


112 


113 


114 


115 


116 


117 


118 


119 


120 


121 


API 


Email/SMS 


DASHBOARDS 


BACKUP Services 


DATA TRANSFER 


Developer Tools 


Mobile Services 


SITE to SITE Point to Point 
API Gateway/ Management 
Email gateway 


prices quoted are for open 
source email solution 


SMS gateway 


Additional public IP Addresses 


Network Monitoring dash Board 
(Per Device/instance) 


Backup agent 


Backup management and 
monitoring 
Back up Restoration 


Bulk Data Transfer 


DATA SYNC service 


Prices quoted are for data sync 
between ESDS Data centers. 


Tools & SDKs or equivalent 


Code Deploy and commit tools 
or equivalent 


Mobile Hub or equivalent 
Mobile SDK 


Container /Registry 


Office 365(Email Service with 100 GB Mail Box for primary and 
archival, Multiparty Video conferencing on PC, Laptop and 
tablets, personal data storage sync from PC to cloud, office 
productivity , search capabilities) or equivalent 


SEC- F- Bare Metal Servers 


1 account with 10 
GB 
1 lakh sms per 
month 
1 


1 


118 


118 


1 instance 


1 instance 


15,000 


70 


11,000 
300 
300 
500 

1,000 


1,000 


3,000 


2,500 


51,000 


51,000 


11,000 
11,000 


51,000 


Intel Xeon E7-8890 v4 (192 Cores, 2.20 GHz),8192GB RAM (8192GB maximum), Up to 29 Internal Hard Drives 
Up to 10Gbps maximum Port Speeds, Redundant Power Supplies, Hypervisor Licenses, network connectivity 
to internet or Cloud infrastructure 


Quad Intel Xeon E7-4890 v2 (60 Cores, 2.80 GHz) 2048GB RAM (2048GB maximum) Up to 24 Internal Hard 


Drives Up to 10Gbps maximum Port Speeds Redundant Power Supplies Hypervisor Licenses, network 


connectivity to internet or Cloud infrastructure 


Intel Xeon E5-2690 v4, Dual Intel Xeon E5-2690 v4 (28 Cores, 2.60 GHz) 256GB RAM (256GB maximum) Up to 
2 Internal Hard Drives Up to 10Gbps maximum Port Speeds Redundant Power Supplies Hypervisor Licenses, 
network connectivity to internet or Cloud infrastructure 


Section G 


MSP Charges 


Additional resources 


1 Virtual CPU 


1GB RAM 


Storage in minimum block of 50 GB 


Additional network segment (per VLAN) 


Additional 1 IP 


Additional 1 sub-admin account 


RateperMonth 
perUnit (Rs)if 


15,000 


70 


11,000 


300 


300 


500 


2,000 


1,000 


3,000 


2,500 


51,000 


51,000 


11,000 
11,000 


51,000 


RateperMonthper 
Unit (Rs)if services 
takenfor2year 


servicestaken 
forlyear 


1 


537,389 510,520 


142,271 135,158 


41,654 39,571 


MONTHLY 
rate per GB 
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2 नेट ने नेट सेर नेट 2 सॅट सेट जेट OK सॅट मॅट OK OK OK OK OK OK OK KK OK KOK 


Public Cloud Virtual Private Cloud Government Community Cloud 
Li Sec Line Items DC-Public DR-Public DC+DR- DC-Virtual DR-Virtual DC+DR- DC-GCC 2 DR-GCC 2 DC+DR-GCC 
n -A Cloud2year Cloud2year Public Cloud Private Private Virtual year year 2 year 
e 2 year Cloud2year Cloud2year Private 
It Cloud 2 year 
e VM c R Sto HO MO HO MO HO MO HO MO HO MO HO MO HO MO HO MO HO MO 
m p A rag URL NTH URL NTH URL NTH URL NTH URL NTH URL NTH URL NTH URL NTH URL NTH 
# u Moe x LY Y LY Y LY Y LY Y LY ग LY ¥ LY ये. LY x LY 
(GB rat rate rat rate rat rate rat rate rat rate rat rate rat rate rat rate rat rate 
) e e e e e e e e e 
1 Pac 1 1 50 8.1 5,90 81 5900 81 5900 82 590 8.2 590 8.2 590 8.2 590 8.2 590 8.2 590 
1 9 0 9 .00 9 .00 0.0 0.0 0.0 0.0 0.0 0.0 
2 Pac 1 2 10 8.5 6,15 8.5 6150 8.5 6150 85 615 8.5 615 8.5 615 8.5 615 8.5 615 8.5 615 
2 0 4 0 4 .00 4 .00 0.0 0.0 0.0 0.0 0.0 0.0 
3 Pac 2 4 10 89 6,45 89 6450 89 6450 | 20 | 645 8 | 0 645 2° | 645 120 | 645 20 | 645 2° | 645 
3 0 6 0 6 .00 6 .00 0.0 0.0 0.0 0.0 0.0 0.0 
| Pac 2 ie 15 9.7 7,00 9.7 7000 9.7 7000 9.7 700 9.7 700 9.7 | 700 9.7 700 9.7 700 9.7 700 
4 0 2 0 2 .00 2 .00 0.0 0.0 0.0 0.0 0.0 0.0 
5 Pac | 2 | 1 15 10. 7,80 10. 7800 10. 7800 10. 780 10 780 10. 780 10. 780 10. 780 10. 780 
5 6 0 83 0 83 .00 83 .00 8 0.0 8 0.0 8 0.0 8 0.0 8 0.0 8 0.0 
हि Pac 4 4 20 10. 7,45 10 7450 10 7450 10. 745 10 745 10. 745 10. 745 10. 745 10. 745 
6 0 35 0 35 .00 35 00 4 0.0 4 0.0 4 0.0 4 0.0 4 0.0 4 0.0 
7 Pac 4 ba 25 11. | 8,00 11. 8000 11. 8000 11. 800 11 800 11. 800 11. 800 11. 800 11. 800 
7 0 11 0 11 .00 11 00 | 1 0.0 1 0.0 1 0.0 1. 0.0 1 0.0 1 0.0 
ol Pac 4 1 25 12. 8,80 12. 8800 12. 8800 12. 880 12 880 12. 880 12. 880 12. 880 12, 880 
8 6 0 22 0 22 .00 22 .00 2 0.0 2 0.0 2 0.0 2 0.0 2 0.0 2 0.0 
चि Pac चि 6 | 30 14. 10,1 14 1015 14 1015 14. 101 14 101 14. 101 14. 101 14. 101 14. 101 
9 0 1 50 10 0.00 10 0.00 1 50.0 1 50.0 1 ५0.0 1 50.0 1 50.0 1 50.0 
1 Pac i 1 35 15. | 10,9 15. 1090 15. 1090 15. 109 15 109 15. 109 15. 109 15. 109 15: 109 
0 2 0 14 00 14 0.00 14 0.00 1 00.0 1 00.0 1 00.0 1 00.0 1 00.0 1 00.0 
10 
1 Pac गि | 40 16. | 11,6 16. 1160 16. 1160 16. 116 16 116 16. 116 16. 116 16 116 16. 116 
1 0 11 00 11 0.00 11 000 1 00.0 1 00.0 1 00.0 1 00.0 1 00.0 1 00.0 
11] 
1 Pac 7 1 45 17. 12,7 17 1270 17 1270 | 17. 127 17 127 17. 427 17. 127 17 127 17; 127 
2 6 (0) 64 00 64 0.00 64 0.00 6 00.0 6 00.0 6 00.0 6 00.0 6 00.0 6 00.0 
12 
1 Pac 7 3 45 20. 14,7 20 1470 20 1470 20. 147 20 147 20. 147 20. 147 20. 147 20. 147 
3 2 0 42 00 42 0.00 42 0.00 4 00.0 4 00.0 4 00.0 4 00.0 4 00.0 4 00.0 
13 
a Pac 1 1 50 17. 12,8 17 1280 17 1280 «17. 128 17 128 17. 128 17. 128 17 128 17, 128 
4 2 |2 0 78 00 78 0.00 78 0.00 8 00.0 8 00.0 8 00.0 8 00.0 8 00.0 8 00.0 
14 
1 Pac 1 2 = 55 20 144 «920. #1440 20. 1440 20. 144 «2120. #144 20. «144 «20. #144 «20. 144 20. = 144 
5 2/4 0 00 00 0.00 00 0.00 0 00.0 0 00.0 0 00.0 0 00.0 0 00.0 0 00.0 
15 
ak Pac 1 1 जि 19. 14,0 is 1400 19 1400 19. 140 19 140 19. 140 19. 140 19 140 19. 140 
6 6 6 0 44 00 44 0.00 44 0.00 4 00.0 4 00.0 4 00.0 4 00.0 4 00.0 4 00.0 
16 
1 Pac 1 3 65 22. 16,1 22. 1610 22. 1610 22. 161 22 161 22. 161 22: 161 22 161 22. 161 
7 6. [32 0 36 00 36 0.00 36 0.00 4 00.0 4 00.0 4 00.0 4 00.0 4 00.0 4 00.0 
17 
1 Pac 3 6 70 55. 39,7 55 3971 55 3971 | SS. 397 55 397 55. 397 55. 397 55 397 55. 397 
8 2 4 0 16 13 16 3.00 16 3.00 2 13.0 | 2 13.0 2 13.0 2 13.0 2 13.0 2 13.0 
18 
1 Pac 6 1 75 88. 63,8 88. 6381 88. 6381 88. 638 88 638 88. 638 88. 638 88 638 88. 638 
9 4 2 0 63 13 63 3.00 63 3.00 6 13.0 6 13.0 6 13.0 6 13.0 6 13.0 6 13.0 
19 8 
2 Pac 1 2 80 155 111, 155 । 1119 | 155 | 1119 | 155 | 111 155 111 155 | 111 155 111 155 111 155 111 
0 2/5 0 A3 913 43 13.0 43 130 4 913. 4 913. 4 913. 4 913. 4 913. 4 913. 
20 8 6 0 0 0 0 0 0 0 0 
2 Bandwidth-Plan 1- 800 
1 upto 100 GB 
2 Bandwidth-Plan 2- 4000 
2 upto 500 GB 
2 Bandwidth-Plan 3- 8000 
3 upto 1000 GB 
2 Additional data 8 
4 transfer tariff per GB 
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Introduction 


Considering the growing adoption of online services by citizens of the State & use of IT 
Within Government, there is a constantly increasing demand from Departments for 
infrastructure for hosting services including disaster recovery and backup for their various IT 
applications. 


Government of Maharashtra has formulated the Cloud Computing Policy of the State. 
(Available on www.maharashtra.gov.in) This policy has come into force from 29.01.2018. As 
per this policy, all Government organizations must use cloud infrastructure services instead 
of using Government owned data centers or data centers owned by the organization or co- 
locating their infrastructure in any Government owned/ privately owned data center. DIT has 
been empanel cloud service providers from whom Departments can avail of cloud services. 


The scope of empanelment is as follows: 


1 Empanelling CSPs for providing cloud service offerings to end user departments 
from specified data centers for a period of 3 years. 

2 Discovering the unit rates for the cloud service offerings which has been apply 
for a period of 2 years. After a period of 2 years, empanelled CSPs has been be 
asked to submit revised rates. 


1 Performance Bank Guarantee 
The Performance Bank Guarantee to be furnished by the empanelled CSP to DIT 
(hereinafter referred to as “PBG”) is for an amount of Rs. 50 Lac. PBG amount will be 
refunded after completion of the contract period (3 years). PBG would be discharged/ 
returned by DIT upon being satisfied that there has been due performance of the 
obligations of the CSP/MSP under the contract at the end of the contract. 


In addition to this, for work order value exceeding Rs. 5 lakhs in a financial year, the 
empanelled CSP to deposit a PBG of 10 % of the contract value with the respective 
user Department within 15 days of issue of work order. 


In the event of the CSP/MSP being unable to service the contract for whatever reason 
DIT would forfeit the PBG. Notwithstanding and without prejudice to any rights 
whatsoever of DIT under the contract in the matter, the proceeds of the PBG shall be 
payable to DIT as compensation for any loss resulting from the CSP/MSPs failure to 
complete its obligations under the Contract. DIT shall notify the CSP/MSP in writing of 
the exercise of its right to receive such compensation within 14 days, indicating the 
contractual obligation(s) for which the CSP/MSP is in default. 


DIT shall also be entitled to make recoveries from the CSP/MSP’s bills, PBG, or 
from any other amount due to him, the equivalent value of any payment made 
to him due to inadvertence, error, collusion, and misstatement. 
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Key Considerations for Cloud Procurement 


S.No Considerations Conventional IT Projects Cloud Service Project 
1. | Requirements The Department needs to estimate | For Cloud Procurement, the 
Estimation the requirements for the total | Department may not undertake the 
(compute, storage, duration of the project (forecasting | estimation for the entire project 
memory, software for 3 or 5 years) and indicates the | duration. The Minimum / Indicative Day 
licenses..,) BoM based on the assessed One requirements can be indicated in 
requirements in the RFP the SCOPE of WORK to be circulated to 
empaneled CSPs 
2. | Flexibility to For a conventional Project, if the | The flexibility to scale up/down and the 
Procure Variable Department has any _ additional | ability to provision virtual machines, 
Quantity of the procurement requirements(servers, | storage and bandwidth dynamically 
Same Service storage,) it has to go through the | enable procurement of additional 
procurement process requirementshasslefree. 
3. | Scenario Based Pricing} Since the requirements for the entire | For cloud procurement two plausible 
duration of project need to be | pricing options are possible: 
specified in the RFP, the pricing | #1- Indicative requirements 
becomes a Fixed Price #2 Minimum Requirements — with 
model indicative PeakLoad 
4, | Payment Model As a corollary to the requirements | With the option of scaling up or down 
and Pricing model,the Paymentterms | based on the requirements, 
are procurement of cloud services is Pay-As- 
fixedtimelinesbased payments You-Goutilitymodel 
5. | Shared Responsibility | The Responsibility of the Project and | The responsibility of the Project, (owing 
deliverables lies with Selected bidder. | to critical Security concerns) is shared 
between the CSP andthe 
Department. 
ति Standardized SLA The conventional IT projects have | SLAs critical to cloud services need to be 
largely well-defined and accepted | identified and to be incorporated in the 
SLAs across the project agreement As defined in section 
Project domains. 4 of this document 
7. | Contractual Clauses | Traditional IT projects have fairly | Contractual clauses Specific to Cloud 


standardized contracts. 


need to be addressed in the SOW (Legal 
Compliance, Exit Management, 
payment terms...) 
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SECTION 2 


Scope of empanelment 


DIT is empanelling cloud service providers offering the following cloud services for 
empanelment of their cloud service offerings for a combination of the Deployment Models 
(Public Cloud, Virtual Private Cloud and Government Community Cloud). 


1. Infrastructure as a Service (laaS) 
2. Platform as a Service (PaaS) 
3. Disaster Recovery as a Service (DRaaS) 


The Government Departments & agencies will select the appropriate cloud service offerings 
based on the risk & security profile of their applications / data / services using guidelines 
issued by DIT from time to time. 


2.1 Requirements 


The requirements for various cloud offerings including laaS, PaaS and DRaaS offerings and 
various deployment models- public cloud, virtual private cloud and Government Community 
Cloud. In future, DIT may expand this list following a process similar to this empanelment. 


As per the cloud policy of the State, a majority of these resources are expected to shift to the 
empanelled CSPs by 30th October 2018. Therefore, in order to create a fast, flexible process 
that capitalizes on the full scale and flexibility of the cloud, Departments may consider the 
following key components while procuring Cloud Services. 


Cloud Services Requirements 

Security — Shared Responsibility 

Migration of Existing Systems to Cloud 
Operational & Monitoring Requirements 

Exit Management/Transitioning out services 
Managed Services 

Role of Government Departments 
Pay-As-You-Go 

Contractual Terms and Service Level Objectives 


५0 ON DUN KRWHN -> 


Migration to Cloud document can be referred to for migrating the applications to cloud of 
Empanelled CSPs. 


2.2 Operational acceptance from Department 
For User Department while getting on boarded onto cloud with support from the MSP, if 


required, Operational Acceptance shall commence once the system is commissioned for a 
period of 30 days. 
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Operational Acceptance will be provided by the Department after cloud resources have been 
provisioned and switchover testing (as applicable) has been completed. Switchover testing 
would include: 


i. Switch over of application from DC to DR as per defined RTO and RPO 
ii. | Switch over applications from DR to DC as predefined RTO and RPO 
iii. | Complete Data Replication and Reverse Data Replication as per RPO 
४. Fully functional application while DR site is operational, taking 

into consideration the end user experience 


In case only DC or DR services have been requested, then operational acceptance will not 
involve switchover testing. 


2.3 Audit by DIT 


DIT will also ensure that third party audit of empanelled Cloud service providers (CSP) is 
carried out at least once a year. 


2.4 Helpdesk Support 


Each empanelled CSP is required to create and maintain a Help Desk / telephonic number and 
email based ticketing system that will resolve problems and answer queries related to DC/DR 
site. The help desk support to users shall be provided on 24x7x365 basis over telephone, chat 
and ticketing system. 
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SECTION 3 
Pricing 
3.1 Pricing model 


Rates discovered through CSP empanelment RFP for a set of options which Departments can 
use are exclusive of taxes. GST will be applicable as per prevailing rates on the date of issue 
of raising the invoices. 


The L1 (lowest) rates for each line item are being notified with a list of technically qualified 
bidders who have agreed to match the L1 rates and the L1 rates for the particular line item. 
The notified rates will be valid for a period of 2 years from the date of notification. 


3.2 Free trial 


To ensure that Departments get a hands on experience before they choose the CSP, all the 
empanelled CSPs will be required to provide Departments with the facility of a free trial fora 
limited period of 30 days whereby users can experience the various cloud offerings before 
the Department decides to select their CSP. 


3.3 Payments linked to utilization 


In the case of virtual machines provisioned by user Departments, the billing for cloud services 
will be be based on actual consumption of services (Pay-As-You-Go model) with zero capital 
(one time) cost. 


To incentivize optimal solution design and encourage proper utilization of the assigned 
computing resources, empanelled CSP in co-ordination with the user Department should 
ensure that the average monthly utilization of RAM, CPU and storage is not less than 50%. 


If the average monthly utilization is less than 50% in a particular month, the CSP should 
immediately notify the user Department. The user Department and the MSP/CSP should 
undertake a joint assessment within 15 days, analyze the reasons for the utilization being less 
than 50% and undertake steps to ensure resource utilization of at least 50%. 


If the average monthly utilization of RAM or CPU or storage is less than 50% for 2 successive 
months, a penalty of 25% of the monthly bill amount (from the next billing cycle) will apply 
for those particular months where utilization is below 50%. 


However, if the CSP has proposed a resource optimization plan to bring the average utilization 
above 50% but such plan has not been approved by the user Department within the above 
time period of 2 months, the penalty will be waived off by DIT. 


If average monthly utilization exceeds 65%, an additional incentive of 5% of the monthly bill 
amount has been be payable to the CSP for a period not exceeding 6 months. 

The expenditure towards cloud services has been be borne by the user Department from their 
budgetary resources. It is clarified that DIT has been not bear the expenditure centrally for 
availing cloud services. 


Empanelled Cloud Service providers should raise quarterly invoices to the respective 
Department. Payments will be ordinarily made by the respective user Department within 1 
month of the raising of the invoice. 
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SECTION 4 
Service level norms 


4.1 Service level norms and Service level agreement 


a) Individual user Departments will enter into service level agreements related to 


implementation (where Department avails of managed services) with the empanelled 
CSP. DIT has been circulate sample templates for the same. 


b) The service level norms for provision of cloud service offerings will be as per the MeiTY 


c) 


document “Guidelines for Government Departments On Service Level Agreement For 
Procuring Cloud Services” published by MeitY on 31%t March 2017. These guidelines 
are available at http://meity.gov.in/writereaddata/files/Guidelines- 
Service _Levels.pdf. In addition to this, DIT reserves the right to lay down service level 
norms for any activities not mentioned in the above document. 


In case the mandated service levels are not achieved, the user Department shall 
invoke the performance related penalties. Payments to the CSP has been linked to the 
compliance with the SLA metrics. To illustrate calculation of penalties, an indicative 
example is provided below. 


e The payment should be linked to the compliance with the SLA metrics. 
e The penalty in percentage of the monthly payment has been be as indicated 
against each SLA parameter in the table. 


For ex: For SLA1 if the penalty to be levied is 7% then 7% of the Quarterly 
Payment is deducted from the total of the Quarterly bill and the balance paid 
to the CSP. 

If the penalties are to be levied in more than one SLA then the total applicable 
penalties are calculated and deducted from the total of the Quarterly bill and 
the balance paid to the CSP. 


For ex: SLA1 =7% of the Quarterly Payment, SLA12=10% of the Quarterly 
Payment, SLA19=2% of the Quarterly Payment then, 


Amount to be paid = Total Quarterly bill - {(19% of the Quarterly Payment)} 
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SECTION 5 
Activities to be performed by MSP 


5.1 System Planning: 
The MSP should submit a detailed plan regarding cloud deployment and configuration to the 
Department. This plan should include the following 


९५ :" 9 £ 9 छ 9 
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CPU, RAM, Storage requirement 

On line and full off line backup of existing system Notification of downtime to end users 
System export window 

Replication tool configuration 

Transfer time of data from DC to DR Data restoration at DR side. 

Data Sync times and dependencies if any Switching on DC servers 

Notifying end users. 

Coordination with other vendors 

Network architecture planning including VLAN configuration planning, IP address planning 
& Subnet planning and routing planning Firewall configuration planning 

Backup methodology 

Failover mechanism for replication links Business continuity Architecture planning 


On acceptance of the above plan by the user Department, the MSP should assist the Department 
in deploying/migrating the Departmental application onto the cloud and offer for testing. 


5.2 Testing: 


Following cloud resource deployment/provisioning, the MSP must perform following testing: 
Functional Testing: Once system is exported, data is migrated to Cloud site and application 
started functioning, the functional testing of Application will be done by the user Department 


a. 


Team along with application vendors. The MSP requires to provide support and co-ordination 


in this case 
Department and application developers/system integrators may perform following testing 


i. Software Module testing as per functional requirement 
ii. User authentications testing. 
iii. | Users add/delete, reports generations 
iv. Heavy application transactions on DR servers 
v. | Data upload/Download 


vi. Connection per second /user per second 
vii. Backup exports 
viii. | Backup restoration 


ix. |SMS/Email Gateway Integeration/testing 
x. | APl integration with other applications if required 
xi. Payment gateway integration 


Data Integrity Testing: Data integrity testing will be performed by Department staff and 
application vendors which would include 


i. Amount of data verification at both end 
ii. Table size and records testing. 
iii. User status at both ends. 
iv. Invoices/transactions verification at both ends. 
Vv. Data in log files. 
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d. Business Continuity Testing: In the event of a disaster at DC site, activation of services from 
the DR site is the responsibility of MSP. The MSP shall develop appropriate policy, checklists in 
line, with ISO 27001 & ISO 20000 framework for failover and fall back to the appropriate DR 


site. 


DR drills needs to be performed by the MSP half yearly to check disaster preparedness. The 
Reverse replication from DR side to DC site also needs to be verified properly by the MSP. 


The testing should include the uninterrupted replication to DC servers & Data integrity test of 
DC servers. The MSP should address any lag in replication due to any unforeseen errors. 


e. Data Ownership 


DATA residing on the CSP/MSP datacenter will not be accessed, modified, deleted 
analyzed and Mined in any way or format by the CSP/MSP or by use of Artificial 
Intelligence without the explicit written consent of the department. 


f. Identity and Access Management for BCP 


Role based access to Department officials and Development team to carry out BCP. 


5.3 Operational Acceptance tests 


The MSP will have to facilitate the Operational Acceptance Tests. Operational acceptance tests will 
be performed by Department; however MSP will have to facilitate Operation Acceptance during 
commissioning of the system (or subsystem[s]), to ascertain whether the system (or major 
component or Subsystem[s]) conforms to the scope of work. The MSP will have to facilitate the 
testing of application from Department users during the Operational Acceptance. Necessary support 
shall be provided by the application vendor of Department. 


5.4 Operations & Maintenance Services 


The MSP shall be responsible for providing maintenance support from the date of issuance of 
operational acceptance by Department. The maintenance and support has been include 
following activities: 


a. Resource Management 


Adequately size the necessary compute, memory, and storage required, building the 
redundancy into the architecture (including storage) and load balancing to meet the 
service levels 

While the initial sizing & provisioning of the underlying infrastructure may be carried 

out based on the information provided by the Department, subsequently, it is 

expected that the MSP, based on the growth in the user load (peak and non-peak 

periods; year-on-year increase), has been scale up or scale down the compute, 

memory, and storage as per the performance requirements of the solution and meet 

the SLAs using the auto-scaling features. 

In addition to auto-scaling, for any major expected increase in the workloads, carry 
out the capacity planning in advance to identify & provision, where necessary, the 
additional capacity to meet the user growth and / or the peak load requirements to 
support the scalability and performance requirements of the solution 

The scaling up / scaling down (beyond the auto-scaling limits or whenever the auto- 
scaling limits have to be changed) has to be carried out with prior approval by 
Department. The MSP should provide the necessary details including the sizing 
calculations, assumptions, current workloads & utilizations, expected growth / 
demand and any other details justifying the request to scale up or scale down. MSP is 
required to provision additional VM’s when the utilization exceeds 80%. 
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b. Patch & Configuration Management 


Manage the instances of storage, compute instances, and network environments. This 
includes Agency-owned & installed operating systems and other system software that 
are outside of the authorization boundary of the MSP. Service Provider is also 
responsible for managing specific controls relating to shared touch points within the 
security authorization boundary, such as establishing customized security control 
solutions. Examples include, but are not limited to, configuration and patch 
management, vulnerability scanning, disaster recovery, and protecting data in transit 
and at rest, host firewall management, managing credentials, identity and access 
management, and managing network configurations. Any required version/Software 
/Hardware upgrades, patch management etc. at the Cloud Site has been be supported 
by the solution provider for the entire contract period at no extra cost to DIT. 


c. User Administration 


Implement Identity and Access Management (IAM) that properly separates users by 
their identified roles and responsibilities, thereby establishing least privilege and 
ensuring that users have only the permissions necessary to perform their assigned 
tasks. 


Administration of users, identities and authorizations, properly managing the root 
account, as well as any Identity and Access Management (IAM) users, groups and 
roles they associated with the user account 


Implement multi-factor authentication (MFA) for the root account, as well as any 
privileged Identity and Access Management accounts associated with it 


d. Security Administration 


vi. 


Vii. 


viii. 


Appropriately configure the security groups in accordance with Department’s 
networking policies 


Regularly review the security group configuration and instance assignment in order 
to maintain a secure baseline. 


Secure and appropriately segregate / isolate data traffic/application by functionality 
using DMZs, subnets etc. 


Ensure that the cloud infrastructure and all systems hosted on it, respectively, are 
properly monitored for unauthorized activity. 


Properly implementing anti-malware and host-based intrusion detection systems on 
their instances, as well as any required network-based intrusion detection systems in 
accordance with the Gol/GoM’s policies. 


Conducting regular vulnerability scanning and penetration testing of the systems, as 
mandated by Gol/GoM’s policies. 


Review the audit logs to identify any unauthorized access to DIT's systems. 
The service provider shall conduct vulnerability and penetration test (from a third 


party testing agency which may be CERT-IN empanelled) on the proposed Cloud 
solution in every 6 months and reports should be shared. 
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ix. | The MSP needs to update the system in response to any adverse findings in the report, 
without any additional cost to Department. Department may also depute auditors to 
conduct security check/ vulnerability test/penetration test. 


e. Monitoring Performance and Service Levels 


i. Provide and implement tools and processes for monitoring the availability of assigned 
applications, responding to system outages with troubleshooting activities designed to 
identify and mitigate operational issues 


ii. | Reviewing the service level reports, monitoring the service levels and identifying any 
deviations from the agreed service levels 


iii. | Monitoring of service levels, including availability, uptime, performance, application 
specific parameters, e.g. for triggering elasticity, request rates, number of users 
connected to a service 

iv. Detecting and reporting service level agreement infringements 


v. Monitoring of performance, resource utilization and other events such as failure of 
service, degraded service, availability of the network, storage, database systems, 
operating Systems, applications, including API access 


vi. | Necessary tools to monitor the root cause for performance degradation of any 
applications. User Department should be able to easily justify whether issue is actually 
an Application issue or Hosting/hardware/Bandwidth issue. 


f. Usage Reporting and Billing Management 
i. Track system usage and usage reports 
ii. | Monitoring, managing and administering the monetary terms of SLAs and other 
billing related aspects 


iii. Provide the relevant reports including real time as well as_ past 
data/information/reports for user Department and DIT to validate the billing and SLA 
related penalties 


iv. _ The following is only an indicative list of MIS reports that may be submitted to DIT: 


Daily reports 
o Summary of resolved, unresolved and escalated issues / 
complaints 
o Log of backup and restoration undertaken 


Weekly reports 

o Summary of systems rebooted. 

o Summary of issues / complaints logged with the OEMs. 

o Summary of changes undertaken in the Data Centre including 
major changes like configuration changes, patch upgrades, etc. 
and minor changes like log truncation, volume expansion, user 
creation, user password reset, etc. 

o Hypervisor patch update status of all servers including the 
Virtual Machines running 


overnment Circular No.: मातंसं - 060/3/2017/1 


e Monthly reports 

o Component wise server as well as Virtual machines availability and 
resource utilization 

© Consolidated SLA / Non- conformance report. Summary of component 
wise uptime. 

o Log of preventive / scheduled maintenance undertaken Log of break- 
fix maintenance undertaken 

o Allrelevant reports required for calculation of SLAs 


e Quarterly reports 
o Consolidated component-wise availability and resource utilization 
o Allrelevant reports required for calculation of SLAs 


The MIS reports shall be in-line with the SLAs and the same shall be scrutinized by the DIT 
g. Backup and restore 


i. Configure, schedule, monitor and manage backups of all the data including but not 
limited to files, images and databases as per the policy finalized by DIT. 
ii. | Restore from the backup on monthly basis and on request where required 


h. Business Continuity Services 
i. Provide business continuity services in case the primary site becomes unavailable 


i. Support for third party audits 
i. Enable the logs and monitoring as required to support for third party audits 


j. Connectivity 
Provide on demand minimum 10 GBPS MPLS connectivity between Department and other 
CSPs/MSPs/DR site for portability and interoperability of applications of Departments and for 
use during BCP. 


5.5. Management / Transition-Out Services 
a. Provide a comprehensive exit management plan, with focus on sustainability 


b. Migration of the VMs, data, content and any other assets to the new environment or on 
alternate Managed Service Provider’s offerings and ensuring successful deployment and 
running of user Department’s solution on the new infrastructure by suitably retrieving all data, 
scripts, software, virtual machine images, and so forth to enable mirroring or copying to 
Agency supplied industry standard media 


c. Ensure that all the documentation required for smooth transition including configuration 
documents are kept up to date 

d. Once the exit process is completed, remove the data, content and other assets from the cloud 
environment and destroy the VM, Content and data of user Department. 
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SECTION 6 
Mandatory compliance requirements 
(As specified in MeitY RFP for empanelment of CSP) 


The compliance must be maintained on an on-going basis in order to retain the empanelment status. 
The CSPs has been have to retain the empanelment status with DIT. The mandatory requirements for 
the respective services in this section also form the minimum scope of work of the empanelled cloud 


service providers when offering cloud services to the end user departments. 


The empanelled cloud service providers has been have to comply with the guidelines & standards 
specified by DIT at the time of their empanelment with DIT. CSP is responsible for all costs associated 
with implementing, assessing, documenting and maintaining the empanelment. 

The empanelled cloud service offerings must comply with the additional guidelines / standards as and 
when such guidelines / standards are published by DIT at no additional cost to retain the empanelment 
status. Cloud Service Providers has been be given sufficient time and notice period to comply with the 
additional guidelines / standards. Any downtime during such upgrades has been not be factored for 


SLA calculations. 


6.1. General Requirements 
The below mandatory requirements are applicable for all cloud deployment models. 


1. Shall be in accordance with the requirements in this application document. 


2. There should be sufficient headroom (at an overall level in the compute, network and storage 
capacity offered) available for near real time provisioning (as per the SLA requirement of the 
Government Department) during any unanticipated spikes in the user load. The provisioning / de- 
provisioning SLAs may differ for the different cloud deployment models. 

3. Ability to integrate fully with the Government of India approved Certificate Authorities to enable 
the Government Departments use the Digital Certificates / Digital Signatures. 

4. The respective Government Department shall retain ownership of any user created/loaded data and 
applications hosted on CSP’s infrastructure and maintains the right to request (or should be able to 
retrieve) full copies of these at any time. 

5. The respective Government Department retains ownership of all virtual machines, templates, 
clones, and scripts/applications created for the department’s application. The respective 
Government Department retains the right to request (or should be able to retrieve) full copies of 
these virtual machines at any time. 

6. The respective Government Department retains ownership of Department loaded software installed 
on virtual machines and any application or product that is deployed on the Cloud by the 


Government Department. 
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10. 


11. 


12. 


13. 


14. 


15. 


The respective Government Department shall be provided access rights (including the underlying 
secure connection) to the user administration / portal of cloud services to have visibility into the 
dashboard, SLAs, management reports, etc. provided by the Cloud Service provider. 

CSP shall not provision any unmanaged VMs for the applications. 

CSPs shall provide interoperability support with regards to available APIs, data portability etc., for the 
Government Department to utilize in case of Change of cloud service provider, migration back to in- 
house infrastructure, burst to a different cloud service provider for a short duration or availing backup 
or DR services from a different service provider. 

Should adhere to the ever evolving guidelines as specified by CERT-In (http://www.cert- 
in.org.in/) 

Should adhere to the relevant standards published (or to be published) by DIT or any standards 
body setup / recognized by Government of India and notified to the CSP by DIT as a mandatory 
standard. 

CSP shall also adhere to the relevant audit requirements as defined in the application document. 
The empanelled cloud service offerings has been have to comply with the guidelines & standards as 
and when such guidelines / standards are published by DIT within the timeframe given by DIT. CSP is 
responsible for all costs associated with implementing, assessing, documenting and maintaining the 
empanelment. 

The empanelled cloud service offerings must comply with any additional guidelines / standards 
(applicable for the Empanelled Cloud Service Offerings) as and when such guidelines / standards 
are published by DIT at no additional cost to retain the empanelment status. Cloud Service 
Providers has been be given sufficient time and notice period to comply to the additional guidelines 
/ standards. Any downtime during such approved upgrades has been be considered as approved 
downtime for SLA calculations. 

DIT has been have the option to extend the Empanelment duration on expiry, to avail the services 
of the CSP for continuation of the services without the need to go for a separate empanelment 
process. The duration of extension has been be decided by DIT and has been be up to a maximum 
of one year. The decision on the extension has been be taken exclusively by Government 
Department keeping in consideration a) satisfactory performance of the Agency b) time constraints 
or other serious impediments in initiation c) technological reasons d) Where circumstances 


inescapably require taking recourse to this option. 


6.2. Service Management and Provisioning Requirements 


The below mandatory requirements are applicable for all cloud deployment models. 


Service Management and Provisioning requirements address the technical requirements for supporting the 


provisioning and service management of the Cloud Service Offerings proposed to be empanelled. Service 


provisioning focuses on capabilities required to assign services to users, allocate resources, and services 


and the monitoring and management of these resources. 
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6.2.1. Service Provisioning 


a) 


b) 


Cc) 
a) 


b) 
Cc) 


d) 


e) 


g) 


Provide the ability to provision virtual machines, storage and bandwidth dynamically (or on- 
demand), on a self-service mode or as requested. 
Enable Service Provisioning via online portal/interface (tools). 


Enable Service Provisioning via Application Programming Interface (API). 
Secure provisioning, de-provisioning and administering [such as Secure Sockets Layer 


(SSL)/Transport Layer Security (TLS) or Secure Shell (SSH)] 
Support the terms of service requirement of terminating the service at any time (on-demand). 
Provide a webpage and associated Uniform Resource Locator (URL) that describes the following: 
Service Level Agreements (SLAs) 
Help Desk and Technical Support 
Resources (Documentation, Articles/Tutorials, etc) 
Make the Management Reports described in this application document accessible via online 
interface. These reports shall be available for one year after being created. 
The CSP is expected to carry out the capacity planning in advance to identify & provision, where 
necessary, the additional capacity to meet the user growth and / or the peak load requirements to 
support the scalability and performance requirements of the solution. There should not be any 
constraints on the services. 
The CSP shall ensure that effective Remote Management features exist so that issues can be 
addressed by the Government Department in a timely and effective manner. 


Service Provisioning shall be available with two factor authentication via the SSL through web 
browser. 


6.2.2. Service Level Agreement Management 


h) 


1) 


)) 


1) 


Provide a robust, fault tolerant infrastructure with enterprise grade SLAs with an assured uptime of 
99.5%, SLA measured at the VM Level & SLA measured at the Storage Levels 
Document and adhere to the SLAs to include: 
Service Availability (Measured as Total Uptime Hours / Total Hours within the Month) displayed 
as a percentage of availability up to one-tenth of a percent (e.g. 99.5%) 
Within a month of a major outage occurrence resulting in greater than 1-hour of unscheduled 
downtime. Describe the outage including description of root-cause and fix. 
Service provisioning and de-provisioning times (scale up and down) in near real- time should be as 
per the SLA requirement of the Government Department. The provisioning / de-provisioning SLAs 
may differ for the different cloud deployment models. 


Helpdesk and Technical support services to include system maintenance windows 


CSP shall implement the monitoring System including any additional tools required for measuring 
and monitoring each of the Service Levels as per the SLA between the Government Department 
and the CSP. 
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6.2.3. Operational Management 


1. Manage the network, storage, server and virtualization layers, to include performance of internal 
technology refresh cycles applicable to meet the SLAs 

2. Provide a secure, dual factor method of remote access which allows the Government Department 
designated personnel (privileged users) the ability to perform duties on the hosted infrastructure 

3. Upgrade and periodically replace hardware without financial impact to the Government 
Department. All the data within it shall be immediately deleted/destroyed and certify the VM and 
data destruction to the Government Department as per stipulations and shall ensure that the data 
cannot be forensically recovered. 

4. Perform patch management appropriate to the scope of their control and/or Provide self-service 
tools to perform patch management 
a. Alerts well in advance on the upcoming patches via email and management portal. 

b. Patch VMs on the next available patch management change window and / or provide self- 
service tools to patch VMs. 

c. Application of automated OS security patches (where OS is the responsibility of the CSP) and 
/ or provide self-service tools for application of OS security patches. 

d. Send regular reminders to the end user Department designated email address five (5) days 
prior to patch cut-off dates 

5. OS level vulnerability management — all OS images created within the cloud platform are regularly 
patched with the latest security updates or the latest security updates are available to the 
Government Department along with the self-service tools to apply the patches as per the 
requirement of the Government Department. 

6. Provide the artifacts, security policies and procedures demonstrating its compliance with the 
Security Assessment and Authorization requirements as described in Security Requirements in this 
application document. 

7. Monitor availability of the servers, CSP -supplied operating system & system software, and 
CSP’s network 

8. The CSP is fully responsible for tech refreshes, patch management and other operations of 
infrastructure that is in the scope of the CSP. 

9. Investigate outages, perform appropriate corrective action to restore the hardware, operating 


system, and related tools 
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1) 


2) 


3) 


CSP should manage CSP provisioned infrastructure including VMs as per the ITIL 
standards. 

Comply with technology refresh requirements as required so as to upgrade any technology 
prior to reaching end of life / end of support and as well as to ensure security requirements 
and service level agreements (SLA) are met. 

Software (limited to OS, security solutions and other platform stack where offered by the 
CSP to the Government Department) has been never be more than two versions behind 
unless deferred or rejected by Government Department. This is not applicable to software 


such as cloud management stack (provisioning, orchestration and metering, etc.). 


6.2.4. Data Management 


a) 
b) 


ट) 


d) 


g) 


h) 


Manage data isolation in a multi-tenant environment. 

The CSP should provide tools and mechanism to the Government Department or its 
appointed agency for defining their backup requirements & policy. 

The CSP should provide tools and mechanism to the Government Department or its 
appointed agency for configuring, scheduling, performing and managing back-ups and 
restore activities (when required) of all the data including but not limited to files, folders, 
images, system state, databases and enterprise applications in an encrypted manner as per 
the defined policy. 

Transfer data back in-house either on demand or in case of contract or order termination 
for any reason 

Manage data remanence throughout the data life cycle. 

Provide and implement security mechanisms for handling data at rest and in transit. 

CSP shall not delete any data at the end of the agreement (for a maximum of 45 days beyond 
the expiry of the Agreement) without the express approval of the Government Department. 
When the Government Department or CSP (with prior approval of the Government 
Department) scales down the infrastructure services, CSP is responsible for deleting or 
otherwise securing Government Department’s Content/data prior to VM deletion and in 


case deleted, shall ensure that the data cannot be forensically recovered. 


6.3. User/Admin Portal Requirements 


The below mandatory requirements are applicable for all cloud deployment models. 


1. Utilization Monitoring 


Provide automatic monitoring of resource utilization and other events such as failure 
of service, degraded service, etc. via service dashboard or other electronic means. 


Real time performance thresholds 
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Real time performance health checks 
Real time performance monitoring & Alerts 
Historical Performance Monitoring 


Capacity Utilization statistics 
Cloud Resource Usage including increase / decrease in resources used during auto-scale 
2. Trouble Management - 
a. Provide Trouble Ticketing via online portal/interface (tools). 
3. User Profile Management 
a. Support maintenance of user profiles and present the user with his/her profile at the 
time of login 


6.4. Integration Requirements 


The below mandatory requirements are applicable for all cloud deployment models. 


1. Provide support to all Application Programming Interfaces (APIs) including REST API 
that CSP develops/provides. 


6.5. LAN / WAN Requirements 
The below mandatory requirements are applicable for all cloud deployment models. 


1. Local Area Network (LAN) shall not impede data transmission.. 
2. Provide a redundant local area network (LAN) infrastructure and static IP addresses from 
customer IP pool or “private” non-internet routable addresses from CSP pool. 
3. Ability to deploy VMs in multiple security zones, as required for the project, defined by 
network isolation layers in the Customer’s local network topology 
4. Provide access to Wide Area Network (WAN) 
5. Provide private connectivity between a Government Department’s network and Data 
Center Facilities 
6. IP Addressing: 
a. Provide IP address assignment, including Dynamic Host Configuration Protocol 
(DHCP). 
b. Provide IP address and IP port assignment on external network interfaces. 
c. Provide dedicated virtual private network (VPN) connectivity. 
d. Allow mapping IP addresses to domains owned by the Government Department, 
allowing websites or other applications operating in the cloud to be viewed externally 
as Government URLs and services. 


7. Provide infrastructure that is IPv6 compliant. 
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8. 


10. 


11. 


12. 


CSP shall support for providing the secure connection to the Data Center and Disaster 
Recovery Center (where applicable) from the Government Department Offices. 

The data center and disaster recovery centre facilities (where applicable) should support 
connection to the wide area network through high bandwidth links of appropriate capacity 
to take care of the needs of various types of user entities. Provision has to be made for 
segregation of access path among various user categories. 

Support dedicated link to the offices of the Government Department to access the data 
center and a separate internet link for the other external stakeholders to get access to 
Government Department services. 

CSP shall have the capability to provide adequate bandwidth between Primary Data 
Center and Disaster Recovery Center for data replication purpose. 

Support network level redundancy through MPLS lines from two different service 
providers, alternate routing paths facilitated at ISP backbone (MPLS), redundant network 
devices etc. These two network service providers should not share same back end 
infrastructure. Redundancy in security and load balancers, in high availability mode, has 


been be provided to facilitate alternate paths in the network 


6.6. Data Center Facilities Requirements 


The below mandatory requirements are applicable for all cloud deployment models. 


1. 


The data center facilities shall cater for the space, power, physical infrastructure 
(hardware). 

The data center facilities and the physical and virtual hardware should be located within 
India 

The space allocated for hosting the infrastructure in the Data Center should be secure. 

The Data Center should be certified for the latest version of ISO 27001 (year 2013) and 
provide service assurance and effectiveness of Management compliant with SSAE 16 / 
ISAE 3402 standards 

The NOC and SOC facility must be within India for the Cloud Environments and the 
managed services quality should be certified for ISO 20000:1. 


CSP should comply to Cloud Security ISO Standard ISO 27017:2015, Privacy Standard ISO 
27018:2015 

The Data Center should conform to at least Tier III standard (preferably certified under 
TIA 942 or Uptime Institute certifications by a 3rd party) and implement tool-based 


processes based on ITIL standards 


. All the physical, environmental and security features, compliances and controls of the Data 


Center facilities (as required under this application document) shall be enabled for the 


environment used for offering cloud services. 
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9. Provide staff, technical and supervisory, in sufficient numbers to operate and manage the 
functioning of the DC & DRC with desired service levels 

10. The data center should comply with the Physical Security Standards as per the latest 
version of ISO 27001 (year 2013) standards. 


6.7. Cloud Storage Service Requirements 
The below mandatory requirements are applicable for all cloud deployment models. 


The service shall be available online, on-demand, and dynamically scalable up or down per request 

for service from the end users (Government Department or Government Department’s nominated 

agencies) with two factor authentication via the SSL through a web browser. 

1. Service shall provide scalable, redundant, dynamic storage 

2. Service shall provide users with the ability to procure storage with two factor authentication 
via the SSL through a web browser and manage storage capabilities remotely via the SSL 
VPN clients as against the public internet. 

3. Service shall provide storage capabilities on-demand, dynamically scalable per request 
and management of the storage via the SSL VPN clients as against the public internet 

4. Storage Space: Online, on-demand virtual storage supporting a single storage sizes in 
multiples of 1 GB 

5. Data Transfer Bandwidth: Bandwidth utilized to transfer files/objects in/out of the 
providers infrastructure supporting a minimum of 100GB of data transferred (in and out) 
within | hour via the network 

6. There shall not be any additional costs associated with data transfer over and above the 


ordinary bandwidth charges, or for bulk transfer for Government Department. 
6.8. Virtual Machine Requirements 
The below mandatory requirements are applicable for all cloud deployment models. 


The service shall be available online, on-demand and dynamically scalable up or down per request 

for service from the end users (Government Department or Government Department’s nominated 

agencies) with two factor authentication via the SSL through a web browser. 

1. Service shall provide auto-scalable, redundant, dynamic computing capabilities or virtual 
machines. 

2. Service shall allow Government Department authorized users to procure and provision 
computing services or virtual machine instances online with two factor authentication via 


the SSL through a web browser. 
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3. 


10. 


11. 


12. 
13. 


14. 


Service shall allow users to securely and remotely load applications and data onto the 
computing or virtual machine instance from the SSL VPN clients only as against the public 
internet. 

Perform an Image backup of Customer VM Image information or support the ability to take 
an existing running instance or a copy of an instance and export the instance into a 


Government Department’s approved image format. 


. Configuration and Management of the Virtual Machine shall be enabled via a Web 


browser over the SSL VPN clients only as against the public internet 
In case of suspension of a running VM, the VM shall still be available for reactivation for 
a reasonable time without having to reinstall or reconfigure the VM for the Government 
Department solution. In case of suspension beyond a reasonable time, all the data within it 
shall be immediately deleted / destroyed and certify the VM and data destruction to the 
Government Department as per stipulations and shall ensure that the data cannot be 
forensically recovered. 
CSP shall ensure that VMs receive OS patching, health checking, Systematic Attack 
Detection and backup functions. 
Monitor VM up/down status and resource utilization such as RAM, CPU, Disk, IOPS and 
network 
CPU (Central Processing Unit) - CPU options shall be provided as follows: 

A minimum equivalent CPU processor speed of 2.4GHz shall be provided. 

The CPU shall support 64-bit operations 
Provide hardware or software based virtual load balancer Services (VLBS) through a 


secure, hardened, redundant CSP Managed Virtual Load Balancer platform 


Provide hardware or software based virtual load balancing as a service to provide stateful 

failover and enable Customers to distribute traffic load across multiple servers. 

Support Clustering 

Operating System (OS) 

a. Service shall support one or more of the major OS such as Windows, LINUX. 

b. Management of the OS processes and log files including security logs retained in 
guest VMs; 

c. Provide anti-virus protection; 

d. Provide OS level security as per CSP standard operational procedures as defined in the 
Information Security Controls for Cloud Managed Services and _ supporting 
documentation; 

Persistence 


a. Persistent Bundled Storage is retained when the virtual machine instance is stopped or 
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15. 


16. 


17. 


18. 


19. 


20. 


21. 


>>: 


23% 


24. 


७. Non-Persistence — Non-Persistence Bundled Storage is released when the virtual 
instance is stopped. If quoting Non-Persistence VM, the CSP shall provide VM Block 
storage 

RAM (Random Access Memory): Physical memory (RAM) reserved for virtual machine 

instance or Computing supporting a minimum of I1GB of RAM. Memory (RAM) 

requirement should be different for different type of servers such as web servers and 
database servers. 

Disk Space options allocated for all virtual machines and file data supporting a minimum 

of 40GB bundled storage. 

Virtual Machine Block Storage Service Requirements 

a. Service shall provide scalable, redundant, dynamic Web-based storage 

b. Service shall provide users with the ability to procure and provision block storage 
capabilities for cloud virtual machines remotely with two factor authentication via the 
SSL through a web browser. 

c. Service shall provide block storage capabilities on-demand, dynamically scalable per 
request for virtual machine instances. 

d. Block Storage - Once mounted, the block storage should appear to the virtual 
machine like any other disk 

e. Storage Space: Online, on-demand storage volumes of arbitrary size ranging from | 
GB to at least 1 TB 

ह. Input/output (I/O) Requests: Input/output requests on block storage 

Government Department retains ownership of all virtual machines, templates, clones, and 

scripts/applications created for the Department’s application 

Government Department retains the right to request full copies of these virtual machines 

at any time. 

Government Department retains ownership of Department loaded software installed on 

virtual machines and any application or product that is deployed on the Cloud by the 

Government Department. 

Support a secure administration interface - such as SSL/TLS or SSH - for the Government 

Department designated personnel to remotely administer their virtual instance 

Provide the capability to dynamically allocate virtual machines based on load, with no 

service interruption 

Provide the capability to copy or clone virtual machines for archiving, troubleshooting, 

and testing 

Cloud provider should offer fine-grained access controls including role based access 


control, use of SSL certificates, or authentication with a multi-factor authentication. 
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25. 


26. 


27. 


28. 
29. 


6.9. 


Cloud service should support auditing with features such as what request was made, the 
source IP address from which the request was made, who made the request, when it was 
made, and so on. 

Government Department should be permitted to bring and upload additional properly 
licensed non-operating system software for operation in cloud as required for the 
Government Department solution for use within the Services by installing it directly on a 
VM. 

RAM or CPU of virtual machine should scale automatically whenever there is spike in 
load to deliver application availability even during spike in load. 


Provide facility to configure virtual machine of required vCPU, RAM and Disk. 
Provide facility to use different types of disk like SAS, SSD based on type of application. 


Disaster Recovery & Business Continuity Requirements 


CSP is responsible for Disaster Recovery Services so as to ensure continuity of operations 
in the event of failure of primary data center of the Government Department and meet the 
RPO and RTO requirements. RPO should be less than or equal to 2 hours and RTO shall 
be less than or equal to 4 hours. The key transaction data shall have RPO of 15 minutes. 
However, during the change from Primary DC to DRC or vice-versa (regular planned 
changes), there should not be any data loss. There shall be asynchronous replication of data 
between Primary DC and DRDC and the CSP has been be responsible for sizing and 
providing the DC-DR replication link so as to meet the RTO and the RPO requirements. 


The Primary DC (of the Government Department) and the DRC should be in different 


seismic zones 


During normal operations, the Primary Data Center (of the Government Department) has 
been serve the requests. The Disaster Recovery Site has been not be performing any work 
but has been remain on standby. During this period, the compute environment for the 
application in DR shall be available but with minimum possible compute resources required 
for a functional DR as per the solution offered. The application environment shall be 
installed and ready for use. DR Database Storage shall be replicated on an ongoing basis 
and shall be available in full (100% of the PDC) as per designed RTO/RPO and replication 
strategy. The storage should be 100% of the capacity of the Primary Data Center site. 
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3. 


In the event of a site failover or switchover, DR site has been take over the active role, and 
all requests has been be routed through that site. Application data and application states has 
been be replicated between data centers so that when an outage occurs, failover to the 
surviving data center can be accomplished within the specified RTO. This is the period 
during which the Compute environment for the application shall be equivalent to DC. The 
installed application instance and the database shall be usable and the same SLAs as DC 
shall be provided. The use of this Full Compute DR environment can be for specific periods 
during a year for the purposes of DC failure or DR Drills or DC maintenance. The Database 
and storage shall be of full capacity and the licenses and security shall be for full 
infrastructure. The bandwidth at the DR shall be scaled to the level of Data center. Users 
of application should be routed seamlessly from DC site to DR site. The CSP shall conduct 
DR drill for two days at the interval of every six months of operation wherein the Primary 
DC has to be deactivated and complete operations shall be carried out from the DR Site. 
However, during the change from DC to DRC or vice-versa (regular planned changes), 


there should not be any data loss. 


The CSP shall clearly define the procedure for announcing DR based on the proposed DR 
solution. The CSP shall also clearly specify the situations in which disaster shall be 
announced along with the implications of disaster and the time frame required for migrating 
to DR. The CSP shall plan all the activities to be carried out during the Disaster Drill and 
issue a notice to the Department at least two weeks before such drill. 

The CSP should offer dashboard to monitor RPO and RTO of each application and 


database. 


The CSP should offer switchover and switchback of individual applications instead of 


entire system. 


Any lag in data replication should be clearly visible in dashboard and alerts of same 


should be sent to respective authorities. 


6.10. Security Requirements 


The below mandatory requirements are applicable for all cloud deployment models. 


1. 


CSP is responsible for provisioning, securing, monitoring, and maintaining the hardware, 
network(s), and software that support the infrastructure and present Virtual Machines 
(VMs) and IT resources to the Government Department. On its part, the Government 
Department is responsible for the security of the “guest” Operating System (OS) and any 


additional software, up to and including the applications running on the guest OS. 
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शः 


10. 


11. 


12. 


13. 


In case, the CSP provides some of the System Software as a Service for the project, CSP is 
responsible for securing, monitoring, and maintaining the System and any supporting 
software. Government Department is responsible for securing and maintaining the 


Government Department application. 


. The Data Center Facility shall at a minimum implement the security toolset: Security & 


Data Privacy (Data & Network Security including Anti-Virus, Virtual Firewall, Multi 
Factor Authentication, VPN, IPS, Log Analyzer / Syslog, SSL, DDOS Protection, HIDS / 
NIDS, Rights Management, SIEM, Integrated Vulnerability Assessment, SOC, Private 
Virtual Zones, Data Privacy, Data Encryption, Certifications & Compliance, 
Authentication & Authorization, and Auditing & Accounting) 

Meet the ever evolving security requirements as specified by CERT-In (http://www.cert- 
in.org.in/) 

Compliance to Cloud Security ISO Standard ISO 27017:2015, Privacy Standard ISO 
27018:2015 and ISO 20000:9 


Meet any security requirements published (or to be published) by DIT or any standards 
body setup / recognized by Government of India from time to time and notified to the CSP 
by DIT as a mandatory standard 
DIT and Government Department reserves the right to verify the security test results. 

a. Incase of the Government Community Cloud, DIT and Government Department 


reserves the right to verify the infrastructure. 


. Implement industry standard storage strategies and controls for securing data in the 


Storage Area Network so that clients are restricted to their allocated storage. 

Deploy public facing services in a zone (DMZ) different from the application services. 
The Database nodes (RDBMS) should be in a separate zone with higher security layer. 
Ability to create non-production environments and segregate (in a different VLAN) non- 
production environments from the production environment such that the users of the 
environments are in separate networks. 

Cloud offering should have built-in user-level controls and administrator logs for 
transparency and audit control 

Cloud Platform should be protected by fully-managed Intrusion detection system using 
signature, protocol, and anomaly based inspection thus providing network intrusion 
detection monitoring. 

Cloud platform should provide Edge-to-Edge security, visibility and carrier-class threat 
management and remediation against security hazards like Denial of Service (DoS) and 
Distributed Denial of Service (DDoS) attacks, botnets, etc. Also, shall provide protection 


against network issues such as traffic and routing instability. 


overnment Circular No.: मातंसं - 060/3/2017/1 


14. 


15. 


16. 


Life 
18. 


19. 


20. 


21. 


22. 


23. 


24. 


25. 


26. 


Cloud platform should provide Web Application Filter for OWASP Top 10 protection as 
a service that can be enabled for Government Departments that require such a service. 
Access to Government Department provisioned servers on the cloud should be through 
SSL VPN clients only as against the public internet. 

Provision of private network ports to be connected to Government Department network for 
additional secure connectivity between Government Department network and the cloud 


through support for MPLS, Fiber, P2P links. 


Virtual Machines should not have console access. 

Cloud Service provider shall allow audits of all administrator activities performed by 
Government Department and allow Government Department to download copies of these 
logs in CSV format. 

Maintain the security features described below, investigate incidents detected, undertake 
corrective action, and report to Government Department, as appropriate 

Deploy and update commercial anti-malware tools (for systems using Microsoft operating 
systems), investigate incidents, and undertake remedial action necessary to restore servers 


and operating systems to operation. 


Shall provide consolidated view of the availability, integrity and consistency of the 
Web/App/DB tiers 

CSP should enforce password policies (complex password, change password in some 
days etc) 

Shall be contractually subject to all Gol IT Security standards, policies, and reporting 
requirements. The CSP shall meet and comply with all Gol IT Security Policies and all 
applicable Gol standards and guidelines, other Government-wide laws and regulations for 


protection and security of Information Technology. 


Shall generally and substantially and in good faith follow Gol guidelines and CERT-In and 
DIT Security guidance. Where there are no procedural guides, use generally accepted 
industry best practices for IT security. 

Information systems must be assessed whenever there is a significant change to the 
system’s security posture 

Conduct regular independent third party assessments of the CSP’s security controls to 
determine the extent to which security controls are implemented correctly, operating as 
intended, and producing the desired outcome with respect to meeting security requirements 


and submit the results to DIT and Government Department 
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27. 


28. 
29. 


30. 
31. 


32. 


33. 


34. 


In case CSP has industry standard certifications (assessed by a third party auditor) that 
verify compliance against the security requirements of the application document, SLA & 
MSA, the results, relevant reports, certifications may be provided with evidence along with 
the mapping of the industry standard certification controls against the application document 
requirements. However, if there are any requirements that do not fall under the industry 
standard certifications, the CSP shall get the Third Party Auditor to assess the the 
conformance to the requirements. 

Provide an independent Security Assessment/Risk Assessment 

DIT reserves the right to perform Penetration Test. If the DIT exercises this right, the CSP 
shall allow DIT’s designated third party auditors to conduct activities to include control 
reviews that include but are not limited to operating system vulnerability scanning, web 
application scanning, and database scanning of applicable systems that support the 
processing, transportation, storage, or security of Department’s information. This includes 
the general support system infrastructure. 

Identified gaps shall be tracked for mitigation in a Plan of Action document. 

CSP is responsible for mitigating all security risks found and continuous monitoring 
activities. All high-risk vulnerabilities must be mitigated within 30 days and all moderate 
risk vulnerabilities must be mitigated within 90 days from the date vulnerabilities are 
formally identified. The Government has been determine the risk rating of vulnerabilities. 
Shall provide access to the DIT or their designee acting as their agent, when requested, in 
order to verify compliance with the requirements for an Information Technology security 
program. DIT reserves the right to conduct on-site inspections. CSP shall make appropriate 
personnel available for interviews and documentation during this review. If documentation 
is considered proprietary or sensitive, these documents may be reviewed on-site under the 
CSP’s supervision. 

Shall provide vulnerability scan reports from Web Application, Database, and Operating 
System Scans or the services for the Government Department to run the vulnerability scan. 
Scan results (that fall under the scope of the CSP) shall be managed and mitigated in Plans 
of Action. 

All documents exclusively produced for the project are the property of the Government 
Department and cannot be reproduced, or retained by the CSP. All appropriate project 
documentation has been be given to Government Department during and at the end of this 
contract or at the time of termination of the contract. The CSP shall not release any project 
information without the written consent of the Government Department. Any request for 
information relating to the Project presented to the CSP must be submitted to the 


Government Department for approval. 
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35. 


36. 


37. 


38. 


CSP shall protect all Government Department data, equipment, etc., by treating the 
information as sensitive. Sensitive but unclassified information, data, and/or equipment has 
been only be disclosed to authorized-personnel. The CSP shall keep the information 
confidential, use appropriate safeguards to maintain its security in accordance with 
minimum standards. When no longer required, this information, data, and/or equipment 
shall be returned to Government Department control, destroyed, or held until otherwise 
directed by the Government Department. The CSP shall destroy unneeded items by 
burning, shredding, or any other method that precludes the reconstruction of the material. 

DIT has the right to perform manual or automated audits, scans, reviews, or other inspections 

of the CSP’s IT environment being used to provide or facilitate services for the 

Government Department through a DIT's designated third party auditor. CSP shall be 

responsible for the following privacy and security safeguards: 

a. CSP shall not publish or disclose in any manner, without the DIT’s written consent, the 
details of any safeguards either designed or developed by the CSP under the Agreement 
or otherwise provided by the Gol & Government Department. 

b. To the extent required to carry out a program of inspection to safeguard against threats 
and hazards to the security, integrity, and confidentiality of any non-public Government 
data collected and stored by the CSP, the CSP shall afford the DIT logical and physical 
access to the CSP’s facilities, installations, technical capabilities, operations, 
documentation, records, and databases within 72 hours of the request. Automated audits 
shall include, but are not limited to, the following methods: 

i. Authenticated and unauthenticated operating system/network vulnerability scans 
1. Authenticated and unauthenticated web application vulnerability scans 
iii. Authenticated and unauthenticated database application vulnerability scans 

Automated scans can be performed by DIT's designated third party auditors, using DIT 

specified tools. If the CSP chooses to run its own automated scans or audits, results from these 

scans may, at the DIT’s discretion, be accepted in lieu of DIT performed vulnerability scans. 

In these cases, scanning tools and their configuration shall be approved by the DIT. In 

addition, the results of CSP-conducted scans shall be provided, in full, to the DIT. 

Submission to regular audits: CSP has been submit to regular audits commissioned by DIT. 

The purpose of these audits has been not only be to ensure conformance with the 

requirements stated in this application document, but also to ensure that the implementation 

is executed in the best of ways to meet the requirements of DIT. These audits may be 
conducted by DIT or DIT's designated third party auditors. CSP has been cooperate fully 
with the auditor. DIT has been inform the CSP of the short-comings if any after the audit 
is completed; and the CSP has been respond appropriately and address the identified gaps. 
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6.11. Legal Compliance Requirements 


The below mandatory requirements are applicable for all cloud deployment models. 


1. IT Act 2000 (including 43A) and amendments thereof 

2. Meet the ever evolving security requirements as specified by CERT-In (http://www.cert- 
in.org.in/) 

3. Meet any security requirements published (or to be published) by DIT or any standards 
body setup / recognized by Government of India from time to time and notified to the CSP 
by DIT as a mandatory standard 

4. All services acquired under this application document including data has been be 
guaranteed to reside in India only. 

5. There shall not be any legal frameworks outside Indian Law applicable to the operation 
of the service (and therefore the information contained within it). 

6. A copy of the contract / MOU (excluding the commercials) between CSP & Government 
Department for the purpose of the project, aligned to the terms & conditions of the 
application document, should be provided to DIT, as and when requested by DIT. 

7. DIT has initiated the process of identification of the Standards, develop the necessary 
specifications, frameworks and guidelines including the guidelines for empanelment of 
cloud service offerings with the help of a Cloud Management Office (CMO). The 
guidelines may also include continuous monitoring of the shared systems that can be 
leveraged by Government to both reduce their security compliance burden and provide 
them highly effective security services. 

a. The empaneled cloud service offerings has been have to comply with the guidelines & 
standards as and when such guidelines / standards are published by DIT within the 
timeframe given by DIT. 

b. CSPs should be prepared to submit the necessary artifacts and the independent 
verification within the timeframe determined by DIT once the guidelines & standards 
are published by DIT. 

c. CSP is responsible for all costs associated with implementing, meeting, assessing, 
documenting and maintaining the empanelment. 

d. The cost of meeting all requirements, getting empaneled and maintaining 
empanelment is the responsibility of CSP. 

e. Ifthe CSP fails to meet the guidelines & standards as set by Gol within the timeframe 
set by DIT, the Government Department reserves the right to terminate the contract and 
request to move to a different CSP that meets the mandatory guidelines & standards at 
no additional cost to Government Department. The Exit Management provisions shall 


come into effect in such a scenario. 
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8. CSP shall be responsible for the following privacy and security safeguards: 


a. 


CSP shall not publish or disclose in any manner, without the Government Department’s 
written consent, the details of any safeguards either designed or developed by the CSP 
under the agreement or otherwise provided by the Government Department or 
Government of India. 

CSP shall adhere to the privacy safeguards as laid down by the DIT and Government 
Department. 

To the extent required to carry out a program of inspection to safeguard against threats 
and hazards to the security, integrity, and confidentiality of any non-public Government 
data collected and stored by the CSP, the CSP shall afford the DIT or its nominated 
agency access to the CSP’s facilities, installations, technical capabilities, operations, 
documentation, records, and databases. 

If new or unanticipated threats or hazards are discovered by either the DIT or 
Government Department, Government or the CSP, or if existing safeguards have ceased 
to function, the discoverer shall immediately bring the situation to the attention of 


CERT-In and the other party. 


6.12.a Management Reporting Requirements 


The below mandatory requirements are applicable for all cloud deployment models. 


Deliverables listed below should be accessible via online interface not later than 10 days after the 


end of the calendar month and available for up to one year after creation. The information shall be 


available in format approved by DIT. The CSP shall monitor and maintain the stated service levels 


as agreed in the Service Level Agreement between the Government Department and the CSP. 


1. 


Service Level Management 


a. 


Service Level Management Reports (as per the service levels agreed in the Service 
Level Agreement between the Government Department and the CSP) 

Service Availability at the VM & Service Availability at the Storage Level (Measured 
as Total Uptime Hours / Total Hours within the Month) displayed as a percentage of 
availability up to one-tenth of a percent (e.g. 99.5%) 

Text description of major outages (including description of root-cause and fix) 


resulting in greater than 1-hour of unscheduled downtime within a month 


2. Network and Security Administration (including security breaches with classification, 


action taken by the CSP and current status) related reports 
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3. Help Desk / Trouble Tickets raised by the DIT and / or Government Department 
Number of Help Desk/customer service requests received. 
b. Number of Trouble Tickets Opened 
c. Number of trouble tickets closed 
d. Average mean time to respond to Trouble Tickets (time between trouble ticket opened 
and the first contact with customer) 
e. Average mean time to resolve trouble ticket 
4. Monthly utilization (including peak and non-peak volumetric details) of the Service 
Offerings for the respective Government Department 
5. Centralized Monitoring & Management and Reporting with: 
Alerts on event threshold and policy based actions upon deviations. 
b. Internet & Intranet Data Transfer 
c. Virtual Instances (VCPU, vMemory, Storage and Network Port) configuration and 
utilization 
d. Storage Volume (Read/Write and IOPS) 


Load balancer 


© 


f. Application Services 


Database Monitoring 


mp ९५ 


Reports on non-conformance and escalation for privileged access by unauthorized 

roles/ identities 

6. Government Department has been have ten (10) business days, to review, accept or reject 
all deliverables. Any comments made by the Government Department shall be addressed 
and a revised deliverable submitted within five (5) business days after the receipt of the 
comments/rejection, unless a further time extension for incorporating the comments is 
approved by Government Department. 

7. Third Party Audit Certification (at the cost of CSP) every six months indicating the 
conformance to the requirements detailed in this application document of the empaneled 
cloud service offerings which are being used by the Government Department. In case the 
empaneled cloud service offerings are not deployed for any Government Department, a 
self-certification every six months indicating the conformance to the requirements detailed 
in this application document, SLA & MSA of the environments & cloud service offerings 
empaneled should be provided to DIT 


8. Any other reports as deemed required by DIT from time-to-time. 
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6.12.b Exit Management and Transition Requirements 
The below mandatory requirements are applicable for all cloud deployment models. 


1. Continuity and performance of the Services at all times including the duration of the Agreement 
and post expiry of the Agreement is a critical requirement of the Government Department. It is 
the prime responsibility of CSP to ensure continuity of service at all times of the Agreement 
including exit management period and in no way any facility/service shall be affected/degraded 
.Further, CSP is also responsible for all activities required to train and transfer the knowledge 
to the Replacement Agency (or Government Department) to ensure similar continuity and 
performance of the Services post expiry of the Agreement. 

2. Atthe end of the contract period or upon termination of contract, CSP is required to provide 
necessary handholding and transition support to ensure the continuity and performance of 
the Services to the complete satisfaction of Government Department. 

3. CSP shall support the Government Department in migration of the VMs, data, content and 
any other assets to the new environment created by the Government Department or any 
Agency (on behalf of the Government) on alternate cloud service provider’s offerings to 
enable successful deployment and running of the Government Department’s solution on 
the new infrastructure. CSP shall certify the VM, Content and data destruction to the 
Government Department as per stipulations and shall ensure that the data cannot be 
forensically recovered. CSP shall have the responsibility to support and assist the 
Government Department till the Department is able to successfully deploy and access the 
services from the new environment. 

4. CSP shall not delete any data at the end of the agreement (for a maximum of 45 days beyond 
the expiry of the Agreement) without the express approval of the Government Department. 

5. During the exit/transition management process, it is the responsibility of the CSP to address 
and rectify the problems with respect to migration of the Department application and related 
IT infrastructure including installation/reinstallation of the system software etc. 

6. The ownership of the data generated upon usage of the system, at any point of time during 
the contract or expiry or termination of the contract, shall rest absolutely with Government 
Department. 

7. During the contract period, the CSP shall ensure that all the documentation required by the 
Government Department for smooth transition including configuration documents are kept 
up to date and all such documentation is handed over to the department during the exit 


management process. 


6.13. Managed Services Requirements 


Applicable only when one or a combination of IaaS, PaaS,DRaaS, DevOps and VDaaS cloud 


service offerings of the Cloud Service Provider (CSP) are proposed to be empaneled. 
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6.13.1. Backup Services 


g. 


h. 


1. 


il. 


11. 


iv. 


The CSP should configure, schedule and manage backups of all the data including but not 
limited to files, folders, images, system state, databases and enterprise applications as per 
the policy defined by DIT or the Government Department. 
The CSP shall be responsible for file system and database backup and restore services. As 
part of the responsibilities the CSP should: 
Perform and store data and file backups (process of duplicating the customers “to-be- 
backed-up” “Target Data’) consisting of an initial full back up with daily incremental 
backups for files; 
For the files, perform weekly backups; 
For the databases, perform a twice weekly full database backup, with a three times 
daily backup of database log files; 
Cloud platform should provide Encryption of all backup files and data and management 
of encryption keys as a service that can be enabled for Government Departments that 
require such a service. 


Monitor and manage backup activity; 


b. Restore the requested data with the objective to initiate a minimum of 95 percent of the 
total number of restore requests per calendar month within a two hour timeframe for 
data that can be restored from a local copy; 

c. Retain inactive versions of backed up flat files for 30 days and the last version of a 
deleted file for 60 days; 

d. Retain database backups for thirty (30) days; 

e. Perform administration, tuning, optimization, planning, maintenance, and operations 
management for backup and restore; 

f. Provide and install additional infrastructure capacity for backup and restore, as 
required; and, 

g. Perform backup on the next scheduled backup window in case of any scheduling 


conflicts between backup and patch management. 


6.13.2. Disaster Recovery & Business Continuity Services 


1. 


In addition to the Primary DC, the CSP is responsible for Disaster Recovery Services so as 
to ensure continuity of operations in the event of failure of primary data center and meet 
the RPO and RTO requirements. RPO should be less than or equal to 2 hours and RTO 
shall be less than or equal to 4 hours. The key transaction data shall have RPO of 15 
minutes. However, during the change from DC to DRC or vice-versa (regular planned 


changes), there should not be any data loss. There shall be asynchronous replication of data 
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between Primary DC and DRDC and the CSP has been be responsible for sizing and 
providing the DC-DR replication link so as to meet the RTO and the RPO requirements. 
2. The Primary DC and the DRC should be in different seismic zones 
3. The DRC can be offered from a traditional Data Center Facility and all the relevant 
mandatory requirements defined for the Primary Data Center as indicated below apply for 
the Disaster Recovery Center 
a. Deployment Model Specific Requirements as defined under Section 5.1 
b. General Requirements as defined under Section 5.2 
c. Service Level Agreement Management as defined under Section 5.3.2 
d. Operational Management as defined under Section 5.3.3 


e. Data Management as defined under Section 5.3.4 


f. User/Admin Portal Requirements under Section 5.4 
g. Integration Requirements under Section 5.5 
h. LAN/WAN Requirements under Section 5.6 


i. Data Center Facilities Requirements under Section 5.7 


j. Security Requirements under Section 5.11 

k. Legal Compliance Requirements under Section 5.12 

1. Management Reporting Requirements under Section 5.13 

m. Exit Management and Transition Requirements under Section 5.14 

4. Incase of any disaster, the security posture of the DR site shall be identical to the posture 
provided in the DC. 

5. The disaster recovery site shall have the similar environment (physical & IT), processes, 
and controls (security, etc.) as that of the primary DC. During normal operations, the 
Primary Data Center has been serve the requests. The Disaster Recovery Site has been not 
be performing any work but has been remain on standby. During this period, the compute 
environment for the application in DR shall be available but with minimum possible 
compute resources required for a functional DR as per the solution offered. The 
application environment shall be installed and ready for use. DR Database Storage shall 
be replicated on an ongoing basis and shall be available in full (100% of the PDC) as per 
designed RTO/RPO and replication strategy. The storage should be 100% of the capacity 
of the Primary Data Center site. 

6. In the event of a site failover or switchover, DR site has been take over the active role, and all 
requests has been be routed through that site. Application data and application states has been 
be replicated between data centers so that when an outage occurs, failover to the surviving data 
center can be accomplished within the specified RTO. This is the period during which the 
Compute environment for the application shall be equivalent to DC. The installed application 


instance and the database shall be usable and the same SLAs as DC shall be provided. The use 
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9. 


of this Full Compute DR environment can be for specific periods during 

i. year for the purposes of DC failure or DR Drills or DC maintenance. The Database and 
storage shall be of full capacity and the licenses and security shall be for full infrastructure. 
The bandwidth at the DR shall be scaled to the level of Data center. Users of application 
should be routed seamlessly from DC site to DR site. The CSP shall conduct DR drill for 
two days at the interval of every six months of operation wherein the Primary DC has to be 
deactivated and complete operations shall be carried out from the DR Site. However, during 
the change from DC to DRC or vice-versa (regular planned changes), there should not be 
any data loss. 

The CSP shall clearly define the procedure for announcing DR based on the proposed DR 
solution. The CSP shall also clearly specify the situations in which disaster shall be 
announced along with the implications of disaster and the time frame required for migrating 
to DR. The CSP shall plan all the activities to be carried out during the Disaster Drill and 


issue a notice to the Department at least two weeks before such drill. 


. The CSP should offer dashboard to monitor RPO and RTO of each application and 


database. 
The CSP should offer switchover and switchback of individual applications instead of 


entire system. 


Any lag in data replication should be clearly visible in dashboard and alerts of same should 


be sent to respective authorities. 
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